Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1529038
MD5:	7ecc730307472ff41577bb1f89352625
SHA1:	e93e76feed4af0f3c390bab25eff25f06af0d3aa
SHA256:	847ab97f46f9ebf8644cef91f88a99b13376b8d1e19cec46b20a9c64f2e013b5
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 3332 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 7ECC730307472FF41577BB1F89352625)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["eaglepawnoy.storec", "spirittunek.storec", "bathdoomgaz.storec", "studennotediw.storec", "mobbipenju.store", "licendfilteo.sitec", "clearancek.site", "dissapoiznw.storec"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T15:43:44.761378+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49705	104.21.53.8	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T15:43:44.761378+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49705	104.21.53.8	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T15:43:42.341755+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.5	62803	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T15:43:42.247875+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.5	49637	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T15:43:42.309379+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.5	59130	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T15:43:42.285329+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.5	63220	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T15:43:42.377141+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.5	57806	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T15:43:42.273213+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.5	50878	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T15:43:42.365402+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.5	56440	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T15:43:42.321249+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.5	60338	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/badges	URL Reputation: Label: malware

Found malware configuration

Source: file.exe.3332.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["eaglepawnoy.storec", "spirittunek.storec", "bathdoomgaz.storec", "studennotediw.storec", "mobbipenju.store", "licendfilteo.sitec", "clearancek.site", "dissapoiznw.storec"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.stor
Source: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.stor
Source: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.stor
Source: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.stor
Source: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.stor
Source: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.stor
Source: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49705 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0022D110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0022D110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_002663B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00265700
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_0026695B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_002699D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_0022FCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_00230EEC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00236F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then dec ebx	0_2_0025F030
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	0_2_00221000
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00264040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00266094
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_0024D1E1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00242260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_00242260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_002342FC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebp, eax	0_2_0022A300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_002523E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_002523E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_002523E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_002523E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_002523E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	0_2_002523E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_0024E40C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_0023B410
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_0024C470
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_00261440
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0023D457
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_002664B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	0_2_00267520
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00236536
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00249510
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	0_2_00228590
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_0024E66A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_0025B650
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_00267710
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_0024D7AF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_002667EF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_002428E9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_00263920
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_0023D961
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_002249A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00231A3C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00264A40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00225A50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00231ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00269B60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	0_2_0023DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	0_2_0023DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00250B80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00233BE2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00231BEE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	0_2_0025FC20
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_00247C00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_0024EC48
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_0024AC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], ax	0_2_0024AC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00269CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_00269CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_0024CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0024CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_0024CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_0024DD29
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	0_2_0024FD10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00268D8A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, ecx	0_2_00234E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00247E60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00245E70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	0_2_0024AE57
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_00226EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	0_2_0022BEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	0_2_00236EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00231E93
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00249F62
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0025FF70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00236F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00267FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00267FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00265FD6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00228FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], 0000h	0_2_0023FFDF

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.5:63220 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.5:62803 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.5:60338 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.5:50878 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.5:56440 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.5:59130 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.5:49637 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.5:57806 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49705 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 104.21.53.8:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: eaglepawnoy.storec
Source: Malware configuration extractor	URLs: spirittunek.storec
Source: Malware configuration extractor	URLs: bathdoomgaz.storec
Source: Malware configuration extractor	URLs: studennotediw.storec
Source: Malware configuration extractor	URLs: mobbipenju.store
Source: Malware configuration extractor	URLs: licendfilteo.sitec
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: dissapoiznw.storec

Source: Joe Sandbox View	IP Address: 104.21.53.8 104.21.53.8
Source: Joe Sandbox View	IP Address: 23.192.247.89 23.192.247.89

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097722809.000000000129C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097722809.000000000129C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097722809.000000000129C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097722809.000000000129C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R
Source: file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=cdfm
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=qu55UpguGheU&l=e
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: file.exe, 00000000.00000003.2085268795.0000000001210000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.0000000001210000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/B
Source: file.exe, 00000000.00000003.2085268795.000000000124E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: file.exe, 00000000.00000003.2085268795.000000000124E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiN
Source: file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiT
Source: file.exe, 00000000.00000002.2097511472.000000000124E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085268795.000000000124E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiX
Source: file.exe, 00000000.00000002.2097511472.000000000124E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085268795.000000000124E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/c
Source: file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/api
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097722809.000000000129C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000003.2085268795.0000000001210000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.0000000001210000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097722809.000000000129C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49705 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00230228	0_2_00230228
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00232030	0_2_00232030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00221000	0_2_00221000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F106B	0_2_003F106B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00264040	0_2_00264040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F60E8	0_2_003F60E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0026A0D0	0_2_0026A0D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003EC13E	0_2_003EC13E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00225160	0_2_00225160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0022E1A0	0_2_0022E1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002271F0	0_2_002271F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E72FF	0_2_003E72FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002212F7	0_2_002212F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002582D0	0_2_002582D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002512D0	0_2_002512D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0022A300	0_2_0022A300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002213A3	0_2_002213A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0022B3A0	0_2_0022B3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002523E0	0_2_002523E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EB39A	0_2_004EB39A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E63DD	0_2_003E63DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0024C470	0_2_0024C470
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00234487	0_2_00234487
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0023049B	0_2_0023049B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002564F0	0_2_002564F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0029E52D	0_2_0029E52D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002235B0	0_2_002235B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00228590	0_2_00228590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F45EF	0_2_003F45EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0023C5F0	0_2_0023C5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0025F620	0_2_0025F620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0022164F	0_2_0022164F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00268652	0_2_00268652
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002686F0	0_2_002686F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003EF6C5	0_2_003EF6C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00342769	0_2_00342769
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00251860	0_2_00251860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0022A850	0_2_0022A850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0025E8A0	0_2_0025E8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0025B8C0	0_2_0025B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004DD917	0_2_004DD917
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002689A0	0_2_002689A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0024098B	0_2_0024098B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00264A40	0_2_00264A40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00267AB0	0_2_00267AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00268A80	0_2_00268A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F2B24	0_2_003F2B24
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0023DB6F	0_2_0023DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00227BF0	0_2_00227BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00268C02	0_2_00268C02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00266CBF	0_2_00266CBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0024CCD0	0_2_0024CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0036CCC1	0_2_0036CCC1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0024DD29	0_2_0024DD29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0024FD10	0_2_0024FD10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00248D62	0_2_00248D62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00234E2A	0_2_00234E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00268E70	0_2_00268E70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0024AE57	0_2_0024AE57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0022BEB0	0_2_0022BEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00236EBF	0_2_00236EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00521E94	0_2_00521E94
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003DAEE9	0_2_003DAEE9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0022AF10	0_2_0022AF10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00267FC0	0_2_00267FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00228FD0	0_2_00228FD0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0023D300 appears 152 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0022CAA0 appears 48 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9995358910891089
Source: file.exe	Static PE information: Section: jhwusxha ZLIB complexity 0.994234180958013

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@10/2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00258220 CoCreateInstance,

0_2_00258220

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 47%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static file information: File size 1902080 > 1048576

Source: file.exe

Static PE information: Raw size of jhwusxha is bigger than: 0x100000 < 0x1a6c00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.220000.0.unpack :EW;.rsrc :W;.idata :W; :EW;jhwusxha:EW;akwhwzrb:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;jhwusxha:EW;akwhwzrb:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1da487 should be: 0x1d198b

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: jhwusxha
Source: file.exe	Static PE information: section name: akwhwzrb
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050E05E push ebx; mov dword ptr [esp], ebp	0_2_0050E07C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046B052 push ecx; mov dword ptr [esp], esi	0_2_0046B2CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0049D05E push ecx; mov dword ptr [esp], 3E3F216Eh	0_2_0049D07F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0049D05E push ebp; mov dword ptr [esp], 5EF7256Dh	0_2_0049D0A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0049D05E push 3D7C7C4Ch; mov dword ptr [esp], ebx	0_2_0049D0F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0049D05E push 0E7631AFh; mov dword ptr [esp], eax	0_2_0049D115
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003A3021 push 74667DD6h; mov dword ptr [esp], eax	0_2_003A3047
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003A3021 push ecx; mov dword ptr [esp], ebx	0_2_003A3055
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003A3021 push 3ED0861Eh; mov dword ptr [esp], edx	0_2_003A306A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003A3021 push 345680ADh; mov dword ptr [esp], ebx	0_2_003A310C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003A3021 push 63A62691h; mov dword ptr [esp], edx	0_2_003A3122
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003A3021 push eax; mov dword ptr [esp], ebx	0_2_003A3164
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003A3021 push 07C455A9h; mov dword ptr [esp], edx	0_2_003A31CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003A3021 push ebp; mov dword ptr [esp], ebx	0_2_003A3203
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003FD00E push esi; mov dword ptr [esp], eax	0_2_003FD05B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003FD00E push ecx; mov dword ptr [esp], 74BEED16h	0_2_003FD076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F106B push ebp; mov dword ptr [esp], 09FDAACFh	0_2_003F111D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F106B push edx; mov dword ptr [esp], eax	0_2_003F11CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F106B push edi; mov dword ptr [esp], ecx	0_2_003F1267
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F106B push 57EA4732h; mov dword ptr [esp], edx	0_2_003F1305
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F106B push eax; mov dword ptr [esp], ebp	0_2_003F1309
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F106B push 6C1A967Eh; mov dword ptr [esp], ebx	0_2_003F13A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F106B push edi; mov dword ptr [esp], 00000001h	0_2_003F1416
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F106B push 32497FF0h; mov dword ptr [esp], ecx	0_2_003F149D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F106B push 1096E496h; mov dword ptr [esp], edi	0_2_003F14BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F106B push ecx; mov dword ptr [esp], 3EB0CF20h	0_2_003F14C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F106B push edi; mov dword ptr [esp], ebx	0_2_003F1578
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F106B push edx; mov dword ptr [esp], ebx	0_2_003F1584
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F106B push edx; mov dword ptr [esp], eax	0_2_003F15FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F106B push edi; mov dword ptr [esp], eax	0_2_003F1659
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F106B push eax; mov dword ptr [esp], esi	0_2_003F1689

Source: file.exe	Static PE information: section name: entropy: 7.98070121153772
Source: file.exe	Static PE information: section name: jhwusxha entropy: 7.9540142875647755

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2841CC second address: 2841D2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FDC2E second address: 3FDC32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FDC32 second address: 3FDC41 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FD14E second address: 3FD159 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FB781486D06h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FD159 second address: 3FD15F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FD15F second address: 3FD16F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jg 00007FB781486D06h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FD407 second address: 3FD429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edi 0x00000006 jne 00007FB781489A06h 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB781489A13h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FD429 second address: 3FD433 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB781486D06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FD433 second address: 3FD446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB781489A0Bh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FD5E3 second address: 3FD5E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E6E14 second address: 3E6E47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FB781489A39h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB781489A0Fh 0x00000013 jmp 00007FB781489A16h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E6E47 second address: 3E6E4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4005F2 second address: 40064D instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB781489A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FB781489A0Fh 0x0000000f popad 0x00000010 xor dword ptr [esp], 47C9E007h 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007FB781489A08h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 00000017h 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 jc 00007FB781489A06h 0x00000037 lea ebx, dword ptr [ebp+124503D3h] 0x0000003d add cx, EA04h 0x00000042 xchg eax, ebx 0x00000043 push ecx 0x00000044 push eax 0x00000045 push edx 0x00000046 jnc 00007FB781489A06h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40072E second address: 400733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400733 second address: 4007D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781489A16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007FB781489A0Dh 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 pushad 0x00000015 push ebx 0x00000016 jmp 00007FB781489A14h 0x0000001b pop ebx 0x0000001c push edx 0x0000001d push esi 0x0000001e pop esi 0x0000001f pop edx 0x00000020 popad 0x00000021 pop eax 0x00000022 jmp 00007FB781489A19h 0x00000027 push 00000003h 0x00000029 mov dword ptr [ebp+1244FF26h], ebx 0x0000002f push 00000000h 0x00000031 jmp 00007FB781489A17h 0x00000036 push 00000003h 0x00000038 mov dword ptr [ebp+122D195Bh], edi 0x0000003e call 00007FB781489A09h 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 jnl 00007FB781489A06h 0x0000004c pushad 0x0000004d popad 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4007D4 second address: 40081C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781486D0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a je 00007FB781486D12h 0x00000010 jns 00007FB781486D0Ch 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a jno 00007FB781486D1Ah 0x00000020 mov eax, dword ptr [eax] 0x00000022 push ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 push esi 0x00000026 pop esi 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4008E4 second address: 4008F2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4008F2 second address: 4008F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4008F6 second address: 4008FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4009BB second address: 4009BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4009BF second address: 400A20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FB781489A0Ch 0x0000000c popad 0x0000000d pop eax 0x0000000e mov si, bx 0x00000011 lea ebx, dword ptr [ebp+124503E7h] 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007FB781489A08h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 00000019h 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 mov dword ptr [ebp+122D375Ah], edx 0x00000037 xchg eax, ebx 0x00000038 je 00007FB781489A17h 0x0000003e jmp 00007FB781489A11h 0x00000043 push eax 0x00000044 pushad 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400A20 second address: 400A28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 420245 second address: 42024B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42024B second address: 42025D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FB781486D0Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42025D second address: 42026D instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB781489A12h 0x00000008 js 00007FB781489A06h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42065D second address: 420667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 420667 second address: 42066C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42066C second address: 420672 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 420821 second address: 420827 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 420827 second address: 420838 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jl 00007FB781486D06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 420AE4 second address: 420AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 420AEA second address: 420B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007FB781486D11h 0x0000000c jnp 00007FB781486D0Ch 0x00000012 ja 00007FB781486D06h 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 420C84 second address: 420C8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 420C8A second address: 420C91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 420C91 second address: 420C9C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jp 00007FB781489A06h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 420C9C second address: 420CB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007FB781486D12h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 420E1C second address: 420E31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781489A0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 420E31 second address: 420E35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 420F87 second address: 420FA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB781489A14h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 421146 second address: 42114A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42140B second address: 42140F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42140F second address: 42141D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jne 00007FB781486D06h 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42141D second address: 421427 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FB781489A06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 421427 second address: 421444 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB781486D15h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 421444 second address: 421448 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 421ADD second address: 421B4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FB781486D12h 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007FB781486D34h 0x00000015 jmp 00007FB781486D19h 0x0000001a jmp 00007FB781486D15h 0x0000001f js 00007FB781486D23h 0x00000025 jmp 00007FB781486D12h 0x0000002a jmp 00007FB781486D0Bh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 421DDA second address: 421DDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 421DDE second address: 421E01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007FB781486D14h 0x0000000e pushad 0x0000000f popad 0x00000010 pop ecx 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 421E01 second address: 421E07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42221B second address: 422225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB781486D06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 422225 second address: 422229 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 422229 second address: 422240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FB781486D0Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 422240 second address: 42224B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnp 00007FB781489A06h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 428D51 second address: 428D57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42935E second address: 429363 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 429363 second address: 429369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 427BEC second address: 427BF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 428352 second address: 428358 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 429419 second address: 42943C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jp 00007FB781489A0Eh 0x0000000d push edi 0x0000000e jng 00007FB781489A06h 0x00000014 pop edi 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 jng 00007FB781489A10h 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42C0D6 second address: 42C0DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42C86B second address: 42C877 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jo 00007FB781489A06h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42C877 second address: 42C894 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781486D19h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42C894 second address: 42C8AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FB781489A0Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42C8AC second address: 42C8B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42CA05 second address: 42CA3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB781489A06h 0x0000000a pop edi 0x0000000b jo 00007FB781489A1Dh 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007FB781489A15h 0x00000018 push esi 0x00000019 jp 00007FB781489A12h 0x0000001f jns 00007FB781489A06h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42CA3C second address: 42CA43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 430702 second address: 430710 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB781489A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 430A27 second address: 430A39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781486D0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 430FBA second address: 430FC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 433C58 second address: 433CB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jnc 00007FB781486D10h 0x0000000c nop 0x0000000d jmp 00007FB781486D16h 0x00000012 push 00000000h 0x00000014 mov edi, dword ptr [ebp+122D3580h] 0x0000001a sub dword ptr [ebp+122D1A53h], ebx 0x00000020 push 00000000h 0x00000022 movsx esi, di 0x00000025 xchg eax, ebx 0x00000026 push edx 0x00000027 jmp 00007FB781486D0Fh 0x0000002c pop edx 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 push edx 0x00000033 pop edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 433CB1 second address: 433CCB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781489A16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 433A41 second address: 433A51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 433A51 second address: 433A65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB781489A10h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 434457 second address: 43445D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4360F0 second address: 4360F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 438790 second address: 438795 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 438795 second address: 43879B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 435E74 second address: 435E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 436917 second address: 43691D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 437540 second address: 437544 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 437544 second address: 43754A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F0BF1 second address: 3F0BF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EBCD6 second address: 3EBCE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB781489A06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43AFFA second address: 43AFFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43AFFE second address: 43B00D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007FB781489A06h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43CF15 second address: 43CF1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43F123 second address: 43F1B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 js 00007FB781489A0Eh 0x0000000c jns 00007FB781489A08h 0x00000012 nop 0x00000013 jno 00007FB781489A0Ch 0x00000019 push dword ptr fs:[00000000h] 0x00000020 clc 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 push 00000000h 0x0000002a push edx 0x0000002b call 00007FB781489A08h 0x00000030 pop edx 0x00000031 mov dword ptr [esp+04h], edx 0x00000035 add dword ptr [esp+04h], 0000001Dh 0x0000003d inc edx 0x0000003e push edx 0x0000003f ret 0x00000040 pop edx 0x00000041 ret 0x00000042 mov di, dx 0x00000045 mov ebx, dword ptr [ebp+122D2C03h] 0x0000004b mov eax, dword ptr [ebp+122D1649h] 0x00000051 mov dword ptr [ebp+124701DBh], edx 0x00000057 push FFFFFFFFh 0x00000059 mov edi, 12EF5C27h 0x0000005e nop 0x0000005f jmp 00007FB781489A10h 0x00000064 push eax 0x00000065 jbe 00007FB781489A10h 0x0000006b pushad 0x0000006c push esi 0x0000006d pop esi 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 441210 second address: 441237 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781486D18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007FB781486D06h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4422AD second address: 4422B7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB781489A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4450D1 second address: 4450D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4450D5 second address: 4450FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB781489A11h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jmp 00007FB781489A0Dh 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 445748 second address: 44574E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44574E second address: 445771 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB781489A18h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4469AA second address: 4469BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 js 00007FB781486D1Dh 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 445928 second address: 44592D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 445A01 second address: 445A0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 445A0B second address: 445A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 447877 second address: 4478C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c add ebx, dword ptr [ebp+122D35F5h] 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007FB781486D08h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 00000014h 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e push eax 0x0000002f pushad 0x00000030 jmp 00007FB781486D10h 0x00000035 jo 00007FB781486D0Ch 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 449A28 second address: 449A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 449A2D second address: 449A41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jno 00007FB781486D06h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 449A41 second address: 449A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44AAC2 second address: 44AAC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44AAC7 second address: 44AACC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 449BA1 second address: 449BA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44AC63 second address: 44AC69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44AC69 second address: 44AC6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44DAB3 second address: 44DABD instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB781489A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 448A28 second address: 448A2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44DABD second address: 44DB4B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FB781489A08h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 movzx ebx, ax 0x00000026 jmp 00007FB781489A0Ah 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edx 0x00000030 call 00007FB781489A08h 0x00000035 pop edx 0x00000036 mov dword ptr [esp+04h], edx 0x0000003a add dword ptr [esp+04h], 0000001Dh 0x00000042 inc edx 0x00000043 push edx 0x00000044 ret 0x00000045 pop edx 0x00000046 ret 0x00000047 mov edi, esi 0x00000049 push 00000000h 0x0000004b jmp 00007FB781489A11h 0x00000050 xchg eax, esi 0x00000051 jg 00007FB781489A0Eh 0x00000057 push eax 0x00000058 push edi 0x00000059 push eax 0x0000005a push edx 0x0000005b jp 00007FB781489A06h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 448A2E second address: 448A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 456EC5 second address: 456EE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FB781489A0Fh 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 456EE0 second address: 456EFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jmp 00007FB781486D10h 0x0000000c jp 00007FB781486D12h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4571D6 second address: 457209 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781489A17h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB781489A16h 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 457209 second address: 457247 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FB781486D0Dh 0x0000000e push eax 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FB781486D0Ah 0x00000016 pop eax 0x00000017 jmp 00007FB781486D14h 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 push ecx 0x00000021 pop ecx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 457247 second address: 457255 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781489A0Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45BA0A second address: 45BA12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45BA12 second address: 45BA18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45BA18 second address: 45BA1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45BA1D second address: 45BA27 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB781489A0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F77F5 second address: 3F7810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 ja 00007FB781486D06h 0x0000000c push eax 0x0000000d pop eax 0x0000000e jnc 00007FB781486D06h 0x00000014 popad 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F7810 second address: 3F7835 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB781489A15h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007FB781489A0Eh 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F7835 second address: 3F783E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E40B second address: 45E41C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007FB781489A08h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E41C second address: 45E421 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E421 second address: 45E43E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB781489A10h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E43E second address: 45E45C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781486D0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007FB781486D08h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E45C second address: 45E483 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB781489A19h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E5F0 second address: 45E5F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E5F5 second address: 45E5FF instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB781489A0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E5FF second address: 45E612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push ebx 0x00000009 jnp 00007FB781486D06h 0x0000000f pop ebx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E612 second address: 45E65C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB781489A06h 0x0000000a popad 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push ebx 0x00000011 jmp 00007FB781489A17h 0x00000016 pop ebx 0x00000017 mov eax, dword ptr [eax] 0x00000019 pushad 0x0000001a jnp 00007FB781489A1Bh 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E65C second address: 45E662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45F9B4 second address: 45F9C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB781489A0Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45F9C3 second address: 45F9C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45F9C7 second address: 45F9E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB781489A12h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45F9E3 second address: 45F9E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45F9E9 second address: 45F9ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45F9ED second address: 45F9FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45F9FA second address: 45FA04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB781489A06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45FA04 second address: 45FA12 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45FA12 second address: 45FA2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781489A12h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45FA2B second address: 45FA31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45FA31 second address: 45FA39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4666B7 second address: 4666D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB781486D15h 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46695E second address: 466985 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FB781489A06h 0x00000009 jne 00007FB781489A06h 0x0000000f pushad 0x00000010 popad 0x00000011 jnl 00007FB781489A06h 0x00000017 popad 0x00000018 pushad 0x00000019 jmp 00007FB781489A0Ch 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466D93 second address: 466D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466D99 second address: 466DC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push esi 0x00000007 push edi 0x00000008 jmp 00007FB781489A16h 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop edi 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 je 00007FB781489A06h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466F35 second address: 466F3F instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB781486D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466F3F second address: 466F64 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB781489A14h 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop ebx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466F64 second address: 466F68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4670B5 second address: 4670BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4670BE second address: 4670C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4670C2 second address: 4670C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46F37B second address: 46F381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46F381 second address: 46F388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46F388 second address: 46F3A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB781486D16h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46F3A2 second address: 46F3A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46F639 second address: 46F68C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781486D0Eh 0x00000007 jmp 00007FB781486D0Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007FB781486D08h 0x00000014 push edi 0x00000015 pop edi 0x00000016 popad 0x00000017 pushad 0x00000018 jmp 00007FB781486D18h 0x0000001d pushad 0x0000001e jns 00007FB781486D06h 0x00000024 pushad 0x00000025 popad 0x00000026 push ebx 0x00000027 pop ebx 0x00000028 popad 0x00000029 jp 00007FB781486D12h 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46F68C second address: 46F692 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46F692 second address: 46F69B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46F7D1 second address: 46F7F1 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB781489A06h 0x00000008 jmp 00007FB781489A10h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46F7F1 second address: 46F7F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46F7F5 second address: 46F80F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB781489A14h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46F80F second address: 46F819 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB781486D12h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46F959 second address: 46F95D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46F95D second address: 46F96F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jg 00007FB781486D08h 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46FFFA second address: 470000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 470000 second address: 470015 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FB781486D06h 0x0000000a popad 0x0000000b jnc 00007FB781486D0Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E5353 second address: 3E5357 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E5357 second address: 3E536F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB781486D0Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E536F second address: 3E5375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E5375 second address: 3E5379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46EDF8 second address: 46EE0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jnp 00007FB781489A06h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4737AD second address: 4737B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB781486D06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4737B7 second address: 4737C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FB781489A0Eh 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4781E7 second address: 4781F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42ECF5 second address: 42ECFB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42ECFB second address: 417AA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781486D0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jng 00007FB781486D0Ch 0x00000012 mov dword ptr [ebp+122D358Ah], eax 0x00000018 mov dword ptr [ebp+122D375Ah], edi 0x0000001e call dword ptr [ebp+12450FE4h] 0x00000024 pushad 0x00000025 jp 00007FB781486D0Ch 0x0000002b je 00007FB781486D06h 0x00000031 jmp 00007FB781486D18h 0x00000036 pushad 0x00000037 push edx 0x00000038 pop edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42F4BD second address: 42F4C2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42F4C2 second address: 42F4EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FB781486D16h 0x0000000d xchg eax, esi 0x0000000e mov dx, 6107h 0x00000012 nop 0x00000013 pushad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42F4EA second address: 42F4F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42F81F second address: 42F823 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42F823 second address: 42F829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42F829 second address: 42F82F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42F82F second address: 42F87E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jg 00007FB781489A1Fh 0x0000000f nop 0x00000010 mov edi, edx 0x00000012 push 00000004h 0x00000014 nop 0x00000015 js 00007FB781489A1Bh 0x0000001b push edx 0x0000001c jmp 00007FB781489A13h 0x00000021 pop edx 0x00000022 push eax 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42FC61 second address: 42FC7E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnc 00007FB781486D06h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB781486D0Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42FED8 second address: 42FEDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42FEDC second address: 42FF0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jmp 00007FB781486D12h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push edx 0x00000012 jns 00007FB781486D08h 0x00000018 pop edx 0x00000019 mov eax, dword ptr [eax] 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42FF0C second address: 42FF10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42FF10 second address: 42FF2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781486D17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42FF2B second address: 42FF30 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42FF30 second address: 42FF3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42FF3F second address: 42FF45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 430056 second address: 43005C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43005C second address: 43009A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007FB781489A08h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 lea eax, dword ptr [ebp+1247EA7Eh] 0x00000029 push eax 0x0000002a mov edi, 73DC1820h 0x0000002f pop ecx 0x00000030 push eax 0x00000031 push esi 0x00000032 je 00007FB781489A0Ch 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4774B2 second address: 4774B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47DF8D second address: 47DFA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FB781489A14h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47DFA6 second address: 47DFAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47DFAE second address: 47DFB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47DFB2 second address: 47DFC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FB781486D12h 0x0000000c jp 00007FB781486D06h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EA25F second address: 3EA266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EA266 second address: 3EA286 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FB781486D19h 0x00000008 pop edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EA286 second address: 3EA2CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB781489A06h 0x0000000a jmp 00007FB781489A15h 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jnp 00007FB781489A15h 0x0000001c jmp 00007FB781489A0Eh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EA2CF second address: 3EA2E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FB781486D0Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EA2E0 second address: 3EA2E9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C972 second address: 47C97E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C97E second address: 47C982 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D61F second address: 47D625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D625 second address: 47D62A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D62A second address: 47D651 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781486D0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB781486D0Fh 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D651 second address: 47D667 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FB781489A10h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D7B7 second address: 47D7C9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB781486D06h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D7C9 second address: 47D7CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D7CD second address: 47D7EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781486D16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D7EB second address: 47D7F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D7F4 second address: 47D7FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47DC77 second address: 47DC97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB781489A14h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47DC97 second address: 47DC9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483D00 second address: 483D06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483D06 second address: 483D17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007FB781486D0Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483D17 second address: 483D1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483D1D second address: 483D23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48416E second address: 48419F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007FB781489A08h 0x0000000b push eax 0x0000000c je 00007FB781489A06h 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FB781489A18h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48419F second address: 4841A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 486A39 second address: 486A3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 486A3D second address: 486A48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4865A8 second address: 4865AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4865AC second address: 4865B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B6C1 second address: 48B6D8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FB781489A11h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B6D8 second address: 48B6F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB781486D16h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B6F2 second address: 48B70B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FB781489A0Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48FC7A second address: 48FC7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48FC7E second address: 48FC84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48FC84 second address: 48FC88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48FC88 second address: 48FCA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007FB781489A0Eh 0x00000010 jp 00007FB781489A06h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48FCA0 second address: 48FCAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FB781486D06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48FCAA second address: 48FCAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48FCAE second address: 48FCBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FB781486D12h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48FCBC second address: 48FCC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F089 second address: 48F08D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F836 second address: 48F866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FB781489A06h 0x0000000a js 00007FB781489A06h 0x00000010 jmp 00007FB781489A13h 0x00000015 popad 0x00000016 js 00007FB781489A0Ch 0x0000001c jg 00007FB781489A06h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494797 second address: 49479C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49479C second address: 4947A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49492D second address: 494939 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007FB781486D06h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494939 second address: 49497C instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB781489A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FB781489A14h 0x00000010 jmp 00007FB781489A15h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a jc 00007FB781489A2Dh 0x00000020 push eax 0x00000021 push edx 0x00000022 push esi 0x00000023 pop esi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42F9ED second address: 42F9F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42FAEE second address: 42FAF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42FAF4 second address: 42FB0B instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB781486D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007FB781486D08h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494E45 second address: 494E97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB781489A18h 0x00000009 js 00007FB781489A08h 0x0000000f popad 0x00000010 pushad 0x00000011 push edx 0x00000012 jmp 00007FB781489A14h 0x00000017 pop edx 0x00000018 jmp 00007FB781489A12h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494E97 second address: 494E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495070 second address: 495076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495076 second address: 495090 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnp 00007FB781486D06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push edx 0x0000000e je 00007FB781486D08h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C7A8 second address: 49C7B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB781489A0Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C7B9 second address: 49C7E8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB781486D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB781486D0Bh 0x00000011 jmp 00007FB781486D18h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D84C second address: 49D855 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49DB82 second address: 49DB88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E43C second address: 49E442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A27F4 second address: 4A27FE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB781486D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A27FE second address: 4A280E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007FB781489A06h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B1718 second address: 4B1720 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00F0 second address: 4B00F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0213 second address: 4B0236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FB781486D11h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 jg 00007FB781486D06h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0236 second address: 4B023D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B067E second address: 4B0684 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0684 second address: 4B0688 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0688 second address: 4B068C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF50B second address: 4AF516 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF516 second address: 4AF51A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF51A second address: 4AF52A instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB781489A06h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF52A second address: 4AF530 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8CAB second address: 4B8CAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8CAF second address: 4B8CC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781486D0Dh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8CC2 second address: 4B8CC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8CC8 second address: 4B8CCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8629 second address: 4B862F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8763 second address: 4B8787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB781486D15h 0x00000009 jne 00007FB781486D06h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8787 second address: 4B87A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB781489A18h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B87A3 second address: 4B87AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B87AB second address: 4B87DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781489A16h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB781489A11h 0x0000000e jp 00007FB781489A06h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B893C second address: 4B8948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB781486D06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8948 second address: 4B897A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB781489A19h 0x00000009 popad 0x0000000a jno 00007FB781489A0Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B897A second address: 4B897E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B897E second address: 4B8984 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6067 second address: 4C606F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C606F second address: 4C608C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 jnl 00007FB781489A1Ch 0x0000000c pushad 0x0000000d jmp 00007FB781489A0Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8E5C second address: 4C8E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB781486D06h 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8E67 second address: 4C8E73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FB781489A06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8E73 second address: 4C8E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C886D second address: 4C8872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8872 second address: 4C889A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781486D13h 0x00000007 ja 00007FB781486D08h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 jc 00007FB781486D06h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C889A second address: 4C889E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8A36 second address: 4C8A3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8A3A second address: 4C8A53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB781489A06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 js 00007FB781489A06h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8A53 second address: 4C8A68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB781486D06h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jno 00007FB781486D06h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB2E4 second address: 4CB2E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB2E8 second address: 4CB2FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jo 00007FB781486D06h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB2FA second address: 4CB304 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB781489A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB304 second address: 4CB319 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB781486D17h 0x00000008 jmp 00007FB781486D0Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CDFA3 second address: 4CDFA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CDFA7 second address: 4CDFED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB781486D11h 0x0000000b jmp 00007FB781486D13h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FB781486D19h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D30D6 second address: 4D30DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D30DA second address: 4D30E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FB781486D06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D471D second address: 4D4741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FB781489A06h 0x0000000a pop ebx 0x0000000b jmp 00007FB781489A10h 0x00000010 push eax 0x00000011 pushad 0x00000012 popad 0x00000013 pop eax 0x00000014 popad 0x00000015 pushad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD453 second address: 4DD459 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD459 second address: 4DD49A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781489A11h 0x00000007 jmp 00007FB781489A14h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB781489A16h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD49A second address: 4DD4D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781486D19h 0x00000007 jmp 00007FB781486D0Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jbe 00007FB781486D18h 0x00000014 push ecx 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 pop ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4C40 second address: 4E4C46 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4C46 second address: 4E4C54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FB781486D12h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4C54 second address: 4E4C61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB781489A06h 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4C61 second address: 4E4C85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB781486D06h 0x0000000a jmp 00007FB781486D13h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4C85 second address: 4E4C89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4F4D second address: 4E4F51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E520F second address: 4E5213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5213 second address: 4E523A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FB781486D25h 0x0000000c jmp 00007FB781486D19h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E523A second address: 4E5255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 jmp 00007FB781489A14h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5255 second address: 4E5260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5260 second address: 4E5264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5D8E second address: 4E5D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5D92 second address: 4E5DB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB781489A0Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007FB781489A06h 0x00000013 jne 00007FB781489A06h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB653 second address: 4EB665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB781486D0Ah 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB1DC second address: 4EB1F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781489A0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EDAE4 second address: 4EDAEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 506FCA second address: 506FDF instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB781489A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jnp 00007FB781489A0Eh 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50970A second address: 50973C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB781486D06h 0x00000008 jmp 00007FB781486D0Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007FB781486D18h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50973C second address: 509742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50CA23 second address: 50CA2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50CB8D second address: 50CB91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50CB91 second address: 50CB95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50CB95 second address: 50CBAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB781489A0Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50CBAF second address: 50CBC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jng 00007FB781486D12h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50CBC6 second address: 50CBE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB781489A18h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50CBE2 second address: 50CBE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52622F second address: 526236 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526236 second address: 526243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526243 second address: 526247 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526396 second address: 5263A0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB781486D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5263A0 second address: 5263F0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB781489A0Ch 0x00000008 jc 00007FB781489A06h 0x0000000e pushad 0x0000000f jno 00007FB781489A06h 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007FB781489A0Dh 0x0000001c popad 0x0000001d pop edx 0x0000001e pop eax 0x0000001f jnc 00007FB781489A3Bh 0x00000025 jmp 00007FB781489A19h 0x0000002a push eax 0x0000002b push edx 0x0000002c push ecx 0x0000002d pop ecx 0x0000002e jne 00007FB781489A06h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52669D second address: 5266A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5267E2 second address: 5267F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB781489A0Fh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52698E second address: 5269B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781486D0Fh 0x00000007 jmp 00007FB781486D0Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5269B0 second address: 5269B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526B38 second address: 526B63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB781486D10h 0x00000009 popad 0x0000000a pushad 0x0000000b jnc 00007FB781486D12h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526B63 second address: 526B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529910 second address: 529919 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5299D0 second address: 5299F3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB781489A18h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5299F3 second address: 5299F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529CAC second address: 529CB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529CB9 second address: 529D01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781486D18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push esi 0x0000000f jmp 00007FB781486D19h 0x00000014 pop esi 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 push edx 0x00000019 push edx 0x0000001a js 00007FB781486D06h 0x00000020 pop edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529D01 second address: 529D2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781489A13h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB781489A0Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529FF7 second address: 529FFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B2F3 second address: 52B2F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090CA8 second address: 5090CB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB781486D0Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090CB6 second address: 5090D06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB781489A0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FB7F1E6FA9Eh 0x00000011 jmp 00007FB781489A16h 0x00000016 test byte ptr [eax+04h], 00000005h 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d pushfd 0x0000001e jmp 00007FB781489A0Ch 0x00000023 xor al, FFFFFFB8h 0x00000026 jmp 00007FB781489A0Bh 0x0000002b popfd 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 434AB0 second address: 434AB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe

Special instruction interceptor: First address: 42EE48 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 1560

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2085268795.0000000001235000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085268795.0000000001210000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.0000000001235000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.0000000001210000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2097511472.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(h"
Source: file.exe, 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00265BB0 LdrInitializeThunk,

0_2_00265BB0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: clearancek.site
Source: file.exe	String found in binary or memory: licendfilteo.site
Source: file.exe	String found in binary or memory: spirittunek.stor
Source: file.exe	String found in binary or memory: bathdoomgaz.stor
Source: file.exe	String found in binary or memory: studennotediw.stor
Source: file.exe	String found in binary or memory: dissapoiznw.stor
Source: file.exe	String found in binary or memory: eaglepawnoy.stor
Source: file.exe	String found in binary or memory: mobbipenju.stor

Source: file.exe, file.exe, 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: @Program Manager

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	631 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	47%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.ZPACK.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/badges	100%	URL Reputation	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	23.192.247.89	true	false	unknown
sergei-esenin.com	104.21.53.8	true	true	unknown
eaglepawnoy.store	unknown	unknown	true	unknown
bathdoomgaz.store	unknown	unknown	true	unknown
spirittunek.store	unknown	unknown	true	unknown
licendfilteo.site	unknown	unknown	true	unknown
studennotediw.store	unknown	unknown	true	unknown
mobbipenju.store	unknown	unknown	true	unknown
clearancek.site	unknown	unknown	true	unknown
dissapoiznw.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
dissapoiznw.storec	true		unknown
studennotediw.storec	true		unknown
licendfilteo.sitec	true		unknown
clearancek.site	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
bathdoomgaz.storec	true		unknown
eaglepawnoy.storec	true		unknown
mobbipenju.store	true		unknown
spirittunek.storec	true		unknown
https://sergei-esenin.com/api	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/my/wishlist/	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=cdfm	file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/en/	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/market/	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/B	file.exe, 00000000.00000003.2085268795.0000000001210000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.0000000001210000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/apiT	file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097722809.000000000129C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/apiN	file.exe, 00000000.00000003.2085268795.000000000124E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097722809.000000000129C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.valvesoftware.com/legal.htm	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/discussions/	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/apiX	file.exe, 00000000.00000002.2097511472.000000000124E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085268795.000000000124E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097722809.000000000129C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/steam_refunds/	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/workshop/	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/legal/	file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097722809.000000000129C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=qu55UpguGheU&l=e	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097722809.000000000129C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/points/shop/	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com:443/api	file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R	file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/c	file.exe, 00000000.00000002.2097511472.000000000124E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085268795.000000000124E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/account/cookiepreferences/	file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097722809.000000000129C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/mobile	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/badges	file.exe, 00000000.00000003.2085268795.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097511472.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2085243003.000000000128B000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.53.8	sergei-esenin.com	United States		13335	CLOUDFLARENETUS	true
23.192.247.89	steamcommunity.com	United States		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529038
Start date and time:	2024-10-08 15:42:49 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@10/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
09:43:41	API Interceptor	3x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.53.8	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	VmRHSCaiyc.exe	Get hash	malicious	LummaC, Vidar	Browse
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse
23.192.247.89	carrier_ratecon.exe	Get hash	malicious	LummaC	Browse
	6JA2YPtbeB.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	github-scanner.com.ps1	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	B0bHdMDGIN.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.Win32.MalwareX-gen.17062.12418.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.FileRepMalware.26149.11274.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.FileRepMalware.26149.11274.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	23.210.122.61
	20fUAMt5dL.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	main.bin	Get hash	malicious	Unknown	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
sergei-esenin.com	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	lHHfXU6Y37.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	VmRHSCaiyc.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.53.8
	j8zJ5Jwja4.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Get hash	malicious	LummaC	Browse	172.67.206.204

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	PO20241008.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	original (3).eml	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://dvj-305jg-9h.car-financeclaim.co.uk/4-604-9vh-9h35g-h3.html#info@tintolaw.co.za	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	PO20241008.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	QPS-36477.xls	Get hash	malicious	Remcos	Browse	188.114.96.3
	PO59458.exe	Get hash	malicious	FormBook	Browse	104.21.73.154
	114mCZlpa3.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Update.js	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	Remittance_Raveis.htm	Get hash	malicious	Unknown	Browse	188.114.96.3
	osjCeEFNrF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
AKAMAI-ASUS	original (3).eml	Get hash	malicious	Unknown	Browse	184.28.90.27
	https://support.squarespacrenewel.retroestyle.com/?DTYUI0=RTDM45	Get hash	malicious	Unknown	Browse	23.38.98.78
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	http://cdn.prod.website-files.com/66006200351a0e5dfaa727ed/66de69bda1d04790a2e6ba98_54204894406.pdf	Get hash	malicious	Unknown	Browse	23.217.172.185
	https://simpleinvoices.io/invoices/gvexd57Lej7	Get hash	malicious	Unknown	Browse	23.56.162.185
	FIR-069114.pdf	Get hash	malicious	HTMLPhisher	Browse	104.118.8.172
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	sakura	Get hash	malicious	Unknown	Browse	104.126.113.20

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	PO20241008.xls	Get hash	malicious	Unknown	Browse	104.21.53.8 23.192.247.89
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.53.8 23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 23.192.247.89
	Oilmax Systems Updated.xls	Get hash	malicious	Unknown	Browse	104.21.53.8 23.192.247.89
	5zA3mXMdtG.exe	Get hash	malicious	SmokeLoader	Browse	104.21.53.8 23.192.247.89
	Lk9rbSoFqa.exe	Get hash	malicious	SmokeLoader	Browse	104.21.53.8 23.192.247.89

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948623808260886
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'902'080 bytes
MD5:	7ecc730307472ff41577bb1f89352625
SHA1:	e93e76feed4af0f3c390bab25eff25f06af0d3aa
SHA256:	847ab97f46f9ebf8644cef91f88a99b13376b8d1e19cec46b20a9c64f2e013b5
SHA512:	ed141115edce576a5909615622a09891e8b60a919e6a70573f1d9b3ce17cd83551f5ac191ee0efc2681b723bf16654cdafbd2b162171538420a06de4fffc7c87
SSDEEP:	24576:ZC3khToHLLLp+F+OU4ppHvxsLRQcFG/UILsJF4P8CYnkDCK0fL+upYmeR+JvJG5f:A3LkF1NARQcFkU36L48RevJo
TLSH:	D1953313E013C3E2CD29A8B698A3838C36180965B1D3F96D960FBCB49DA7815D57EDF4
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................L...........@..........................0L...........@.................................W...k..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8c0000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB7807244CAh
pmulhuw mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FB7807264C5h
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x25e00	7b5f4608fbf27f3046b805d75e5d6204	False	0.9995358910891089	data	7.98070121153772	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	fe72def8b74193a84232a780098a7ce0	False	0.150390625	data	1.04205214219471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x60000	0x2b8000	0x200	47d15d15e163bee913147ca6c0408e6e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jhwusxha	0x318000	0x1a7000	0x1a6c00	46f39d06355aabd9e283a47aecb92104	False	0.994234180958013	data	7.9540142875647755	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
akwhwzrb	0x4bf000	0x1000	0x600	14db79331cfda7efeb9f4c92dd829af0	False	0.576171875	data	4.975212112404469	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4c0000	0x3000	0x2200	c0494e733a6883ec28e55a714a18f987	False	0.05215992647058824	DOS executable (COM)	0.6174986606595725	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T15:43:42.247875+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.5	49637	1.1.1.1	53	UDP
2024-10-08T15:43:42.273213+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.5	50878	1.1.1.1	53	UDP
2024-10-08T15:43:42.285329+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.5	63220	1.1.1.1	53	UDP
2024-10-08T15:43:42.309379+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.5	59130	1.1.1.1	53	UDP
2024-10-08T15:43:42.321249+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.5	60338	1.1.1.1	53	UDP
2024-10-08T15:43:42.341755+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.5	62803	1.1.1.1	53	UDP
2024-10-08T15:43:42.365402+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.5	56440	1.1.1.1	53	UDP
2024-10-08T15:43:42.377141+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.5	57806	1.1.1.1	53	UDP
2024-10-08T15:43:44.761378+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49705	104.21.53.8	443	TCP
2024-10-08T15:43:44.761378+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	104.21.53.8	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 15:43:42.418294907 CEST	49704	443	192.168.2.5	23.192.247.89
Oct 8, 2024 15:43:42.418348074 CEST	443	49704	23.192.247.89	192.168.2.5
Oct 8, 2024 15:43:42.418447971 CEST	49704	443	192.168.2.5	23.192.247.89
Oct 8, 2024 15:43:42.419775963 CEST	49704	443	192.168.2.5	23.192.247.89
Oct 8, 2024 15:43:42.419792891 CEST	443	49704	23.192.247.89	192.168.2.5
Oct 8, 2024 15:43:43.061167955 CEST	443	49704	23.192.247.89	192.168.2.5
Oct 8, 2024 15:43:43.061271906 CEST	49704	443	192.168.2.5	23.192.247.89
Oct 8, 2024 15:43:43.065994024 CEST	49704	443	192.168.2.5	23.192.247.89
Oct 8, 2024 15:43:43.066008091 CEST	443	49704	23.192.247.89	192.168.2.5
Oct 8, 2024 15:43:43.066385984 CEST	443	49704	23.192.247.89	192.168.2.5
Oct 8, 2024 15:43:43.112325907 CEST	49704	443	192.168.2.5	23.192.247.89
Oct 8, 2024 15:43:43.137218952 CEST	49704	443	192.168.2.5	23.192.247.89
Oct 8, 2024 15:43:43.179408073 CEST	443	49704	23.192.247.89	192.168.2.5
Oct 8, 2024 15:43:43.531537056 CEST	443	49704	23.192.247.89	192.168.2.5
Oct 8, 2024 15:43:43.531600952 CEST	443	49704	23.192.247.89	192.168.2.5
Oct 8, 2024 15:43:43.531713963 CEST	49704	443	192.168.2.5	23.192.247.89
Oct 8, 2024 15:43:43.531732082 CEST	443	49704	23.192.247.89	192.168.2.5
Oct 8, 2024 15:43:43.531744957 CEST	443	49704	23.192.247.89	192.168.2.5
Oct 8, 2024 15:43:43.531752110 CEST	443	49704	23.192.247.89	192.168.2.5
Oct 8, 2024 15:43:43.531773090 CEST	49704	443	192.168.2.5	23.192.247.89
Oct 8, 2024 15:43:43.531773090 CEST	49704	443	192.168.2.5	23.192.247.89
Oct 8, 2024 15:43:43.531816959 CEST	49704	443	192.168.2.5	23.192.247.89
Oct 8, 2024 15:43:43.620466948 CEST	443	49704	23.192.247.89	192.168.2.5
Oct 8, 2024 15:43:43.620635986 CEST	443	49704	23.192.247.89	192.168.2.5
Oct 8, 2024 15:43:43.620794058 CEST	49704	443	192.168.2.5	23.192.247.89
Oct 8, 2024 15:43:43.620826006 CEST	443	49704	23.192.247.89	192.168.2.5
Oct 8, 2024 15:43:43.620898962 CEST	49704	443	192.168.2.5	23.192.247.89
Oct 8, 2024 15:43:43.622854948 CEST	443	49704	23.192.247.89	192.168.2.5
Oct 8, 2024 15:43:43.622921944 CEST	443	49704	23.192.247.89	192.168.2.5
Oct 8, 2024 15:43:43.622966051 CEST	49704	443	192.168.2.5	23.192.247.89
Oct 8, 2024 15:43:43.622987032 CEST	443	49704	23.192.247.89	192.168.2.5
Oct 8, 2024 15:43:43.623013973 CEST	443	49704	23.192.247.89	192.168.2.5
Oct 8, 2024 15:43:43.623034000 CEST	49704	443	192.168.2.5	23.192.247.89
Oct 8, 2024 15:43:43.623069048 CEST	49704	443	192.168.2.5	23.192.247.89
Oct 8, 2024 15:43:43.623725891 CEST	49704	443	192.168.2.5	23.192.247.89
Oct 8, 2024 15:43:43.623759031 CEST	443	49704	23.192.247.89	192.168.2.5
Oct 8, 2024 15:43:43.623773098 CEST	49704	443	192.168.2.5	23.192.247.89
Oct 8, 2024 15:43:43.623780966 CEST	443	49704	23.192.247.89	192.168.2.5
Oct 8, 2024 15:43:43.802859068 CEST	49705	443	192.168.2.5	104.21.53.8
Oct 8, 2024 15:43:43.802963972 CEST	443	49705	104.21.53.8	192.168.2.5
Oct 8, 2024 15:43:43.803075075 CEST	49705	443	192.168.2.5	104.21.53.8
Oct 8, 2024 15:43:43.804018974 CEST	49705	443	192.168.2.5	104.21.53.8
Oct 8, 2024 15:43:43.804056883 CEST	443	49705	104.21.53.8	192.168.2.5
Oct 8, 2024 15:43:44.283832073 CEST	443	49705	104.21.53.8	192.168.2.5
Oct 8, 2024 15:43:44.283936024 CEST	49705	443	192.168.2.5	104.21.53.8
Oct 8, 2024 15:43:44.335205078 CEST	49705	443	192.168.2.5	104.21.53.8
Oct 8, 2024 15:43:44.335261106 CEST	443	49705	104.21.53.8	192.168.2.5
Oct 8, 2024 15:43:44.336251020 CEST	443	49705	104.21.53.8	192.168.2.5
Oct 8, 2024 15:43:44.337416887 CEST	49705	443	192.168.2.5	104.21.53.8
Oct 8, 2024 15:43:44.337505102 CEST	49705	443	192.168.2.5	104.21.53.8
Oct 8, 2024 15:43:44.337853909 CEST	443	49705	104.21.53.8	192.168.2.5
Oct 8, 2024 15:43:44.761326075 CEST	443	49705	104.21.53.8	192.168.2.5
Oct 8, 2024 15:43:44.761549950 CEST	443	49705	104.21.53.8	192.168.2.5
Oct 8, 2024 15:43:44.761637926 CEST	49705	443	192.168.2.5	104.21.53.8
Oct 8, 2024 15:43:44.762037992 CEST	49705	443	192.168.2.5	104.21.53.8
Oct 8, 2024 15:43:44.762096882 CEST	443	49705	104.21.53.8	192.168.2.5
Oct 8, 2024 15:43:44.762129068 CEST	49705	443	192.168.2.5	104.21.53.8
Oct 8, 2024 15:43:44.762145042 CEST	443	49705	104.21.53.8	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 15:43:42.247874975 CEST	49637	53	192.168.2.5	1.1.1.1
Oct 8, 2024 15:43:42.266091108 CEST	53	49637	1.1.1.1	192.168.2.5
Oct 8, 2024 15:43:42.273212910 CEST	50878	53	192.168.2.5	1.1.1.1
Oct 8, 2024 15:43:42.283626080 CEST	53	50878	1.1.1.1	192.168.2.5
Oct 8, 2024 15:43:42.285329103 CEST	63220	53	192.168.2.5	1.1.1.1
Oct 8, 2024 15:43:42.306065083 CEST	53	63220	1.1.1.1	192.168.2.5
Oct 8, 2024 15:43:42.309379101 CEST	59130	53	192.168.2.5	1.1.1.1
Oct 8, 2024 15:43:42.318624973 CEST	53	59130	1.1.1.1	192.168.2.5
Oct 8, 2024 15:43:42.321249008 CEST	60338	53	192.168.2.5	1.1.1.1
Oct 8, 2024 15:43:42.339029074 CEST	53	60338	1.1.1.1	192.168.2.5
Oct 8, 2024 15:43:42.341754913 CEST	62803	53	192.168.2.5	1.1.1.1
Oct 8, 2024 15:43:42.359375954 CEST	53	62803	1.1.1.1	192.168.2.5
Oct 8, 2024 15:43:42.365401983 CEST	56440	53	192.168.2.5	1.1.1.1
Oct 8, 2024 15:43:42.375437021 CEST	53	56440	1.1.1.1	192.168.2.5
Oct 8, 2024 15:43:42.377140999 CEST	57806	53	192.168.2.5	1.1.1.1
Oct 8, 2024 15:43:42.387501001 CEST	53	57806	1.1.1.1	192.168.2.5
Oct 8, 2024 15:43:42.390106916 CEST	56531	53	192.168.2.5	1.1.1.1
Oct 8, 2024 15:43:42.398437023 CEST	53	56531	1.1.1.1	192.168.2.5
Oct 8, 2024 15:43:43.627616882 CEST	52518	53	192.168.2.5	1.1.1.1
Oct 8, 2024 15:43:43.798336029 CEST	53	52518	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 15:43:42.247874975 CEST	192.168.2.5	1.1.1.1	0x2975	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:43:42.273212910 CEST	192.168.2.5	1.1.1.1	0xf5bc	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:43:42.285329103 CEST	192.168.2.5	1.1.1.1	0xb80	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:43:42.309379101 CEST	192.168.2.5	1.1.1.1	0x6ec3	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:43:42.321249008 CEST	192.168.2.5	1.1.1.1	0x236d	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:43:42.341754913 CEST	192.168.2.5	1.1.1.1	0xc6c1	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:43:42.365401983 CEST	192.168.2.5	1.1.1.1	0xd9d8	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:43:42.377140999 CEST	192.168.2.5	1.1.1.1	0x3710	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:43:42.390106916 CEST	192.168.2.5	1.1.1.1	0x2514	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:43:43.627616882 CEST	192.168.2.5	1.1.1.1	0x67d0	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 15:43:42.266091108 CEST	1.1.1.1	192.168.2.5	0x2975	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:43:42.283626080 CEST	1.1.1.1	192.168.2.5	0xf5bc	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:43:42.306065083 CEST	1.1.1.1	192.168.2.5	0xb80	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:43:42.318624973 CEST	1.1.1.1	192.168.2.5	0x6ec3	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:43:42.339029074 CEST	1.1.1.1	192.168.2.5	0x236d	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:43:42.359375954 CEST	1.1.1.1	192.168.2.5	0xc6c1	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:43:42.375437021 CEST	1.1.1.1	192.168.2.5	0xd9d8	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:43:42.387501001 CEST	1.1.1.1	192.168.2.5	0x3710	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:43:42.398437023 CEST	1.1.1.1	192.168.2.5	0x2514	No error (0)	steamcommunity.com		23.192.247.89	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:43:43.798336029 CEST	1.1.1.1	192.168.2.5	0x67d0	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:43:43.798336029 CEST	1.1.1.1	192.168.2.5	0x67d0	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

sergei-esenin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	23.192.247.89	443	3332	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 13:43:43 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-08 13:43:43 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Tue, 08 Oct 2024 13:43:43 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=2a852ed74aa060ea649eb48c; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-08 13:43:43 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-08 13:43:43 UTC	10062	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-08 13:43:43 UTC	10261	IN	Data Raw: 74 3b 56 49 44 45 4f 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 76 69 64 65 6f 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 4d 4d 55 4e 49 54 59 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 6f 6d 6d 75 6e 69 74 79 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 4d 4d 55 4e 49 54 59 5f 43 44 4e 5f 41 53 53 45 54 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 Data Ascii: t;VIDEO_CDN_URL":"https:\/\/video.akamai.steamstatic.com\/","COMMUNITY_CDN_URL":"https:\/\/community.akamai.steamstatic.com\/","COMMUNITY_CDN_ASSET_URL":"https:\/\/cdn.akamai.steamstatic.com\/steamcommunit

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	104.21.53.8	443	3332	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 13:43:44 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-08 13:43:44 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-08 13:43:44 UTC	801	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 13:43:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2ba802btptd5subuujgh9bpbgj; expires=Sat, 01 Feb 2025 07:30:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HMsXTCUzSh8gm0H3%2BBSAUnnYXcloBMNq6G1WWeWJHYQw9AEzoqOKxNLA5V9bJNsL9jLCaaMBDhUFT4W%2B32a2h8gIxowbhJIMFbfG%2FnkBeQ7hnSi2NCG%2BDqhgaDYB%2FzNWmwPMsQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cf68fc6789817ad-EWR
2024-10-08 13:43:44 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-08 13:43:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:43:38
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x220000
File size:	1'902'080 bytes
MD5 hash:	7ECC730307472FF41577BB1F89352625
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	68%
Total number of Nodes:	50
Total number of Limit Nodes:	4

Executed Functions

Function 0022FCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

t, xrefs: 0022FCBE
J|BJ, xrefs: 0023000D
V, xrefs: 0022FEDC
VY^_, xrefs: 0022FDFF

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: J|BJ$V$VY^_$t
API String ID: 0-3701112211
Opcode ID: ce4ed2544da4867431d055b90c993211850647ddbe905752cd5ca20b3401346d
Instruction ID: 30c9af229d28b0c09c83442d0558717a9b53e0ecca3af3d25f5b4718c0b7c458
Opcode Fuzzy Hash: ce4ed2544da4867431d055b90c993211850647ddbe905752cd5ca20b3401346d
Instruction Fuzzy Hash: 21D199B452C391ABD314DF5495A061FBBF1AB92B44F14882CF4C98B252C335CD19DBA2

Function 0022D110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 0022D2F1

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: a76ad9af62cc22ef25f44caddb0f261333375aaf7a7609769c8645db8f1c34b5
Instruction ID: 60a1ac39608cd2a2a34abf7001edfc246498cfae09c67044be58311a182854df
Opcode Fuzzy Hash: a76ad9af62cc22ef25f44caddb0f261333375aaf7a7609769c8645db8f1c34b5
Instruction Fuzzy Hash: 5C41457052D390ABC301BFA4E584A2EFBF5AF52705F548D0CE8C497212C335E8249B67

Function 00265700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 00265784

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ecfc24a996f3ed1d97cf44ddc1fbd78e795ba98268092e8e1f6928f7feeff53d
Instruction ID: e66f20748568f314844f052759e6bf7c24208b857738ac06838efd4da624b718
Opcode Fuzzy Hash: ecfc24a996f3ed1d97cf44ddc1fbd78e795ba98268092e8e1f6928f7feeff53d
Instruction Fuzzy Hash: FE11A37152C250EBC302EF18E844A1BFBF9AF86710F058828E4C89B211D335D9A0DB97

Function 00265BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0026973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 00265BDE

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 0026695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 002669C5

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: a5a89e107c7aa3b8216c94ce19eb56fcc7cb5457ce4042085456a3f733b27737
Instruction ID: ca3492c13a47a27b069c9e3ee85a11e740b737e57c0d3a1780cb3f0f7cb50073
Opcode Fuzzy Hash: a5a89e107c7aa3b8216c94ce19eb56fcc7cb5457ce4042085456a3f733b27737
Instruction Fuzzy Hash: 1631AAB05283029FD718DF14D8A872BF7F1EF85344F18881CE5C6A7261E77499A4CB96

Function 0023049B Relevance: .3, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6c220fdd5cce20dbaaa4b4baa2bdf82127dac1ab332b142183a2a02a4d76fd4
Instruction ID: 29409f3f02c7725b7d07fddb13fd641aa8eecbe656fd27a4539a6b3f7e9ac491
Opcode Fuzzy Hash: a6c220fdd5cce20dbaaa4b4baa2bdf82127dac1ab332b142183a2a02a4d76fd4
Instruction Fuzzy Hash: 21917975210B00DFD724CF25E898A17B7F6FF89310F118A6CE8568BAA1D771E815CB60

Function 00230228 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118cc8a0b47c15cdde2b8eb3bfb56cc3f788e80c7c488ad4ffc943371116b66f
Instruction ID: db915ab5b5e19f33730576555c833034cd5a7b838fc77332a531c3d373895e75
Opcode Fuzzy Hash: 118cc8a0b47c15cdde2b8eb3bfb56cc3f788e80c7c488ad4ffc943371116b66f
Instruction Fuzzy Hash: 83718975210701DFDB248F20E898B17B7F6FF49310F10C9A8E8568B662C771E825CB60

Function 002699D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b118305bae548838991701e18b645b71b14933f8fba03842e3dcd5ec8367ffa
Instruction ID: 9384ab626175679b401787f0a4f89102b8aa9b716a2a34ec685ec672b11dedef
Opcode Fuzzy Hash: 2b118305bae548838991701e18b645b71b14933f8fba03842e3dcd5ec8367ffa
Instruction Fuzzy Hash: D141BE34228301ABD714DF55E990B2BF7F9EB85714F14882CE58997241D771ECE0CB62

Function 002663B8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cafdd1165ec1b334e764a82d948201b337181658a663b594df4b3f61c5246787
Instruction ID: 63f5765e990da49410a2071d0fb5883cea1ef25e95de896c1b672e07c7353dd1
Opcode Fuzzy Hash: cafdd1165ec1b334e764a82d948201b337181658a663b594df4b3f61c5246787
Instruction Fuzzy Hash: 48310670619302FBD624DF04DD8AF3BB7A6FB80B15F64450CF185572D1D770A8A08B52

Function 00230EEC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 628df38da50e146a7f016e4b8b433163e0cb023b8c0dfbe26124e0b3cbe86769
Instruction ID: 5aa4ee8177dbf6ef62769ddb27c066097fb9e50c8a85eaad47870ddb9a3f1d04
Opcode Fuzzy Hash: 628df38da50e146a7f016e4b8b433163e0cb023b8c0dfbe26124e0b3cbe86769
Instruction Fuzzy Hash: 462128B491021A9FDB15CF94DCA0BBEBBB5FB4A304F144849E415BB292C735A911CF64

Function 004EFF79 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 107
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 004F0903
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 004F0997

Strings

V, xrefs: 004F0974

Memory Dump Source

Source File: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: V
API String ID: 2087232378-1342839628
Opcode ID: 87798781d91622e159a105389bea212caaa734f9b5c9abe1ff45d5314bcbd2e6
Instruction ID: 5c6270bdbfe723fce2f82f5d7ea644ed9c29f19d222e1f32f39dca79edb4e439
Opcode Fuzzy Hash: 87798781d91622e159a105389bea212caaa734f9b5c9abe1ff45d5314bcbd2e6
Instruction Fuzzy Hash: AD414EB060124EDFEB109F28CC88BAF37A4EF48315F544025AE45D7B92E67A9C64CB5D

Function 00263220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 002632A6

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c69453cb77f344dbae48f4326bda4245c635135c34ac6610fdf68fc6cdae7258
Instruction ID: ceba884c1b81f76ad7e67d78cf1cc864c83fcb5b31431c7322a7d80214700bc8
Opcode Fuzzy Hash: c69453cb77f344dbae48f4326bda4245c635135c34ac6610fdf68fc6cdae7258
Instruction Fuzzy Hash: 88016D3450D2509BC711EF18E899A1ABBF8EF4A700F05485CE5C98B361D335DDA4DB92

Function 00263202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00263208

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e5f898d002b7f5983676c857455c179c1bf72b6e58d44b3eec54f924b4ded4a9
Instruction ID: ef18bd06edf7e19b693cf83c3e36744075967e11e7ffa0696c18f2f1f9c2a481
Opcode Fuzzy Hash: e5f898d002b7f5983676c857455c179c1bf72b6e58d44b3eec54f924b4ded4a9
Instruction Fuzzy Hash: 2CB01130080000AFEA082B00FC0EF003A20EF00A0AF8000A0A208080B2E2A2A8A8CAA8

Non-executed Functions

Function 0023DB6F Relevance: 32.0, Strings: 24, Instructions: 2006COMMON

Download Yara Rule

Strings

mjkh, xrefs: 0023E7D8
AR, xrefs: 0023DD10
()./, xrefs: 0023E9CA
D, xrefs: 0023E846
DCBA, xrefs: 0023E887, 0023E896
`onm, xrefs: 0023E733
tsrq, xrefs: 0023E6FC
lkji, xrefs: 0023E73E
`Y^_, xrefs: 0023E99E
<=2, xrefs: 0023EA01
LKJI, xrefs: 0023E6E6
T, xrefs: 0023F157
:WUE, xrefs: 0023F6B7, 0023F6C6
<=:;, xrefs: 0023E930
%*+(, xrefs: 0023DE37, 0023DE46
89>?, xrefs: 0023E9F6
WP, xrefs: 0023DCEF
tuJK, xrefs: 0023E967
89&', xrefs: 0023E93B
|, xrefs: 0023ECB1
QNOL, xrefs: 0023E775
@ONM, xrefs: 0023E6DB
xgfe, xrefs: 0023E71D
dcba, xrefs: 0023E728

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+($()./$89&'$89>?$:WUE$<=2$<=:;$@ONM$AR$D$DCBA$LKJI$QNOL$T$WP$`Y^_$`onm$dcba$lkji$mjkh$tsrq$tuJK$xgfe$|
API String ID: 2994545307-1418943773
Opcode ID: 473c3c0e435c7ac1810dc9365555e040aa5247dedd5d2d0a45be7bdd92eacd0c
Instruction ID: 1e913a1e6b90640c3aa7480c7ee910dc1b3d82b21d151ac1969137b2acce240a
Opcode Fuzzy Hash: 473c3c0e435c7ac1810dc9365555e040aa5247dedd5d2d0a45be7bdd92eacd0c
Instruction Fuzzy Hash: 4DF288B05183829BD774CF14D484BABBBE6BFD5304F544C2CE4C98B291D77199A8CB92

Function 002523E0 Relevance: 31.3, APIs: 4, Strings: 12, Instructions: 3298COMMON

Download Yara Rule

Strings

fedc, xrefs: 00252782
{l`~, xrefs: 0025268C
Cx, xrefs: 0025453D
aenQ, xrefs: 0025276A
f@~!, xrefs: 002525FF
`tii, xrefs: 00252693
:, xrefs: 002532DD
%*+(, xrefs: 002540EF
mlc@, xrefs: 0025275C
|}&C, xrefs: 00252F21
3<, xrefs: 002532D6
ggxz, xrefs: 00252685

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: %*+($3<$:$Cx$`tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~$|}&C
API String ID: 0-786070067
Opcode ID: 1c5bb023d923226a4967b87cdfa432ac8bd0ec0331f14ac31cc6f839eca1725d
Instruction ID: 7e384d87d00fb441e04e553148337da909e698aa8767baf78c2cf1f794606988
Opcode Fuzzy Hash: 1c5bb023d923226a4967b87cdfa432ac8bd0ec0331f14ac31cc6f839eca1725d
Instruction Fuzzy Hash: 6D33CD70124B81CFD7258F38C590762BBE1BF16305F58998DD8DA8BB82C335E81ACB65

Function 00249F62 Relevance: 21.7, Strings: 17, Instructions: 473COMMON

Download Yara Rule

Strings

sm, xrefs: 0024A830
?m,o, xrefs: 0024A13C
WH, xrefs: 0024AA1C
hi, xrefs: 0024AB9D
_Y, xrefs: 0024A641
WQ, xrefs: 0024A62B
N[, xrefs: 0024A375
JG, xrefs: 0024AA27
/), xrefs: 0024A66D
]{, xrefs: 0024A1E7, 0024A1F3
(a*c, xrefs: 0024A147
CG, xrefs: 0024AA32
Gt, xrefs: 00249FF8
kW, xrefs: 0024A380
S], xrefs: 0024A636
%e6g, xrefs: 0024A152
=], xrefs: 0024A36A

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: %e6g$(a*c$=]$?m,o$CG$Gt$JG$N[$WH$]{$hi$kW$/)$S]$WQ$_Y$sm
API String ID: 0-1131134755
Opcode ID: 8068df21ef69c3f394e4411991e282a2c66173b7ba30c3cc20e139b39d7d5c88
Instruction ID: 11f2b9e58ef2b7ad5148ab818a7195d3397bd0d3e8694f6df2790544d3f61354
Opcode Fuzzy Hash: 8068df21ef69c3f394e4411991e282a2c66173b7ba30c3cc20e139b39d7d5c88
Instruction Fuzzy Hash: 3352C6B804D385CAE274CF25D581B8EBAF1BB92740F608A1DE5ED9B255DBB08045CF93

Function 00249510 Relevance: 20.4, Strings: 16, Instructions: 427COMMON

Download Yara Rule

Strings

G+X5, xrefs: 00249AF3
,A&C, xrefs: 0024982E
B7U1, xrefs: 00249AFB
;IJK, xrefs: 0024983E
B?Q9, xrefs: 00249B0B
X/R), xrefs: 00249AEB
pq, xrefs: 002499E0
G'M!, xrefs: 00249ADB
8;, xrefs: 00249B13
!E4G, xrefs: 00249836
L3Y=, xrefs: 00249B03
O+f), xrefs: 00249634, 0024963D
z=Q?, xrefs: 00249826
?M0K, xrefs: 00249968
T#a-, xrefs: 00249AE3
2A"_, xrefs: 00249980

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: 850f5aacc0af6a55fd53c7c520a1c06fbd93d9b60d60d5fc30607052dae402bc
Instruction ID: 58416abb03f67afb3518b783341048c77ea37a751dfd4b5584b364c692725c35
Opcode Fuzzy Hash: 850f5aacc0af6a55fd53c7c520a1c06fbd93d9b60d60d5fc30607052dae402bc
Instruction Fuzzy Hash: F3F15FB0528381ABD314DF15D881A2BBBF4FB8AB48F144D0CF4D99B252D374D998CB96

Function 0024DD29 Relevance: 18.6, Strings: 14, Instructions: 1142COMMON

Download Yara Rule

Strings

$, xrefs: 0024E403, 0024E664, 0024E7BD
Y9N;, xrefs: 0024E245
)IgK, xrefs: 0024E261
=]+_, xrefs: 0024E276
%*+(, xrefs: 0024E143
,Q?S, xrefs: 0024E26F
n\+H, xrefs: 0024DDC0
-M2O, xrefs: 0024E25A
<Y.[, xrefs: 0024E27D
hX]N, xrefs: 0024DDC7
upH}, xrefs: 0024DE8A, 0024E798, 0024DF4A
{E, xrefs: 0024E323
r$, xrefs: 0024E92E
$, xrefs: 0024E9C5

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: $$%*+($)IgK$,Q?S$-M2O$<Y.[$=]+_$Y9N;$hX]N$n\+H$r$$upH}${E$$
API String ID: 0-155823083
Opcode ID: 9dc15367a409c39b77692e071459f467fb9d17466f9bbbd1376f89d88dde649b
Instruction ID: 1085dc30f5d910076e3237132b2581a66b7987d7b528aac6ff3546324f4b5618
Opcode Fuzzy Hash: 9dc15367a409c39b77692e071459f467fb9d17466f9bbbd1376f89d88dde649b
Instruction Fuzzy Hash: CD920471E10215CFEB18CF68D8417AEBBB2FF49310F298168E456AB391D735AD61CB90

Function 003EC13E Relevance: 12.9, Strings: 9, Instructions: 1619COMMON

Download Yara Rule

Strings

kuB\, xrefs: 003ECD23
l/[, xrefs: 003EC91A
l/[, xrefs: 003EC90E
Z5w, xrefs: 003ECF77
2;{7, xrefs: 003EC3F4
J>j, xrefs: 003ECA4B
U7k, xrefs: 003ED105
Z5w, xrefs: 003ECF8D
\mU_, xrefs: 003ED245

Memory Dump Source

Source File: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: l/[$l/[$2;{7$J>j$U7k$Z5w$Z5w$\mU_$kuB\
API String ID: 0-1014254643
Opcode ID: 47970cf8750fc3b19e44944b87ea737b058b68eae6ef2e7c0825e8d1ee4ee143
Instruction ID: e9e2bcd5958028dcf5b1568748d70fd57ca5318df493cfbc93dda0192ce939e8
Opcode Fuzzy Hash: 47970cf8750fc3b19e44944b87ea737b058b68eae6ef2e7c0825e8d1ee4ee143
Instruction Fuzzy Hash: 85B229F3A0C2149FE3046E2DEC8567AFBE9EFD4720F16863DEAC483744E93558058692

Function 0024098B Relevance: 10.8, Strings: 8, Instructions: 836COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00240A77, 00240A86
,#15, xrefs: 00240F94
cah`, xrefs: 0024107E
{, xrefs: 00241502
&> &, xrefs: 00240F89
gce/, xrefs: 00241073
9.5^, xrefs: 00240F9F
qrqp, xrefs: 00241089

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: %*+($&> &$,#15$9.5^$cah`$gce/$qrqp${
API String ID: 0-4102007303
Opcode ID: 2c503b472d2f964238f325f83849f6d2a3ba537700a118ddade9b10a0036c60d
Instruction ID: 08bc61052f34c8e54b541283cd4e3cf49e652c5bfd4e12be817fff1da300f5a5
Opcode Fuzzy Hash: 2c503b472d2f964238f325f83849f6d2a3ba537700a118ddade9b10a0036c60d
Instruction Fuzzy Hash: FD6298B16183818BD334CF14D895BABB7E1FF96314F04492DE49A8B641E3759894CF53

Function 00221000 Relevance: 10.5, Strings: 7, Instructions: 1785COMMON

Download Yara Rule

Strings

0123456789abcdefxp, xrefs: 00221587, 002215F8
0123456789ABCDEFXP, xrefs: 0022157D, 002215EB
gfff, xrefs: 00222226
@, xrefs: 00222C40
-, xrefs: 002221ED
gfff, xrefs: 00222297
gfff, xrefs: 002222E1

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$@$gfff$gfff$gfff
API String ID: 0-2517803157
Opcode ID: 6b139dc2c7137411309514cdcc29c11338b6a7d7a63f2cebeae72c3ee25c55c9
Instruction ID: 3d7a281c21042b8a1be0c9a199e3d0a656286e0fca8224d9c7ee6037607bb215
Opcode Fuzzy Hash: 6b139dc2c7137411309514cdcc29c11338b6a7d7a63f2cebeae72c3ee25c55c9
Instruction Fuzzy Hash: AFD27A31628362AFC714CE68D48076ABBE2AFD4314F18C62DE499C7391D775DD29CB82

Function 003F106B Relevance: 10.4, Strings: 7, Instructions: 1619COMMON

Download Yara Rule

Strings

!_, xrefs: 003F11F7
-JW, xrefs: 003F133D
{-y, xrefs: 003F14A0
qXV/, xrefs: 003F2098
!io, xrefs: 003F1BFC
E_], xrefs: 003F1AB3
fO, xrefs: 003F1DD4

Memory Dump Source

Source File: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: !_$!io$-JW$E_]$qXV/${-y$fO
API String ID: 0-2293751018
Opcode ID: 102c012a26f8b871ff087e531b064d4be2295a420671878e9b163f41aad2b47b
Instruction ID: 4ca475194aaec3a50007fbda08a80e071c136d06c1e0d1c002ef40f7950a524a
Opcode Fuzzy Hash: 102c012a26f8b871ff087e531b064d4be2295a420671878e9b163f41aad2b47b
Instruction Fuzzy Hash: 1FB217F360C204AFE3046E2DEC8567AFBE9EF94620F1A493DE6C4C7744EA3558058697

Function 003E72FF Relevance: 10.3, Strings: 7, Instructions: 1560COMMON

Download Yara Rule

Strings

Scw, xrefs: 003E814F
Q-S, xrefs: 003E7C33
x7S}, xrefs: 003E730F
TFt, xrefs: 003E7A0B
;s, xrefs: 003E7F60
`r?, xrefs: 003E7644
F>w, xrefs: 003E7CC9

Memory Dump Source

Source File: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: F>w$Q-S$Scw$TFt$`r?$x7S}$;s
API String ID: 0-3545414784
Opcode ID: dba02250bb061d0a28900353b296551336061f928c1a847eaac7bec99064c534
Instruction ID: 9ab91261e046bbe5d96b5009b004a8406a7a5ecf56d7b81105b272560a1068ae
Opcode Fuzzy Hash: dba02250bb061d0a28900353b296551336061f928c1a847eaac7bec99064c534
Instruction Fuzzy Hash: 1FB2D5F36086009FE3046E2DEC8577ABBE9EF94320F1A493DE6C4C7744EA3598458796

Function 003F2B24 Relevance: 7.9, Strings: 5, Instructions: 1619COMMON

Download Yara Rule

Strings

%^, xrefs: 003F3B56
&a%_, xrefs: 003F369A
$Vwy, xrefs: 003F3805
B)v?, xrefs: 003F3BC4
Vwy, xrefs: 003F3800

Memory Dump Source

Source File: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: Vwy$$Vwy$&a%_$B)v?$%^
API String ID: 0-1513166269
Opcode ID: 34379e451d6b6b09b1c0bb9644105bd1ced49437201e0a67688abd003447a102
Instruction ID: f829f68262669dd0a4405994fe1a9b2247e604a9a8186c585c44da5809b5ffb0
Opcode Fuzzy Hash: 34379e451d6b6b09b1c0bb9644105bd1ced49437201e0a67688abd003447a102
Instruction Fuzzy Hash: E2B2E7F360C2049FE304AE2DEC8567AB7E9EF94720F1A493DE6C4C7744EA3598058697

Function 002212F7 Relevance: 7.2, Strings: 5, Instructions: 922COMMON

Download Yara Rule

Strings

0, xrefs: 00221DC1
0, xrefs: 0022243E
0, xrefs: 00221E88
@, xrefs: 00223531
i, xrefs: 002228EA

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 619d57298324f0d5a9b3aefc8296fc9b5aecd9530dace5093d894166fcbf2ab3
Instruction ID: d95efcd81494efc13a1e13d1ea1b4e997353c01321323273fc6a010de0202639
Opcode Fuzzy Hash: 619d57298324f0d5a9b3aefc8296fc9b5aecd9530dace5093d894166fcbf2ab3
Instruction Fuzzy Hash: A262253162C3A2EFC318CF68D48076ABBE1AFD4304F18891DE8D987291D775D959CB82

Function 0022164F Relevance: 6.7, Strings: 5, Instructions: 472COMMON

Download Yara Rule

Strings

0123456789abcdefxp, xrefs: 00221659
gfff, xrefs: 00221F57
0123456789ABCDEFXP, xrefs: 0022164F
gfff, xrefs: 00221F3C
+, xrefs: 00221573

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: +$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-1123320326
Opcode ID: 29df7208e8dec573f7e82f6bed3fb1ff06137d76f324693b6d3abc30810eaa20
Instruction ID: 2b909a56555b66d963841be3b09d6310ab44ff34a18fc05b5c5c8f9ce43b8481
Opcode Fuzzy Hash: 29df7208e8dec573f7e82f6bed3fb1ff06137d76f324693b6d3abc30810eaa20
Instruction Fuzzy Hash: C1F1F53061C392AFC715CE68D48076AFBE1AFD9304F188A6DE4D987352C375D958CB82

Function 002213A3 Relevance: 6.6, Strings: 5, Instructions: 390COMMON

Download Yara Rule

Strings

0123456789abcdefxp, xrefs: 002213AD
gfff, xrefs: 00221F57
0123456789ABCDEFXP, xrefs: 002213A3
gfff, xrefs: 00221F3C
-, xrefs: 00221F23

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-3620105454
Opcode ID: 9a3072226c7975befb0d0b6b90099ae0624122ba170d803047aae391dd03f9f1
Instruction ID: 5bd562e94cb6b2d990c6d360992b606e6ae9ac5efa12e729696a13c76641fd78
Opcode Fuzzy Hash: 9a3072226c7975befb0d0b6b90099ae0624122ba170d803047aae391dd03f9f1
Instruction Fuzzy Hash: 9ED1F13161C392AFC315CE69D48066AFFE2AFD9304F08CA6DE4C987352D235D958CB52

Function 003F45EF Relevance: 6.6, Strings: 4, Instructions: 1569COMMON

Download Yara Rule

Strings

@>?_, xrefs: 003F4E15
3-#s, xrefs: 003F4D99
q7{, xrefs: 003F5143
fm/}, xrefs: 003F497C

Memory Dump Source

Source File: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: 3-#s$@>?_$fm/}$q7{
API String ID: 0-3194165872
Opcode ID: b517c12e805d1e6c193bfe157d5b95bd56c82827305ae05053212bb9c6bb9d2b
Instruction ID: 560ce7ff095a0be808758b71d0b5144ae3e6688ea1106e02676969abb706a426
Opcode Fuzzy Hash: b517c12e805d1e6c193bfe157d5b95bd56c82827305ae05053212bb9c6bb9d2b
Instruction Fuzzy Hash: 6AB2F6F36082049FE3046E29EC8567AF7E9EF94720F1A493DEAC4C7744E63599018797

Function 003E63DD Relevance: 5.7, Strings: 4, Instructions: 668COMMON

Download Yara Rule

Strings

OGfg, xrefs: 003E6663
naU, xrefs: 003E6816
bKo{, xrefs: 003E65F4
lo, xrefs: 003E6426

Memory Dump Source

Source File: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: OGfg$bKo{$naU$lo
API String ID: 0-1895836283
Opcode ID: 386af079ec9d6887c2805747b94bcd0a7b15a01cd2fec5052c182b44bac10f0a
Instruction ID: 5cdc04da527a5615b8fd88169238d251253e21ca363dd832013cf7c4401a2462
Opcode Fuzzy Hash: 386af079ec9d6887c2805747b94bcd0a7b15a01cd2fec5052c182b44bac10f0a
Instruction Fuzzy Hash: E522E6F360C200AFE354AE6DEC8577ABBE9EF98720F15893DE6C4C7744E63598008656

Function 0024FD10 Relevance: 5.7, Strings: 4, Instructions: 667COMMON

Download Yara Rule

Strings

m1s3, xrefs: 0024FEC3, 0024FECB
NA_I, xrefs: 0025036D
uvw, xrefs: 0024FE95
:, xrefs: 00250087

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: :$NA_I$m1s3$uvw
API String ID: 0-3973114637
Opcode ID: 14e5ecea71de55b88d4d18f19488c59644c6529648d7eec137cb84ed8966b9c1
Instruction ID: ba8b31e9762d3e6e9552f8ccf4fef702f5d844304b98fe8651aacaf1b4966ade
Opcode Fuzzy Hash: 14e5ecea71de55b88d4d18f19488c59644c6529648d7eec137cb84ed8966b9c1
Instruction Fuzzy Hash: 4232CAB0528381DFD310DF28E881B2ABBE5AF89301F14496CF9D58B292D335D969CF56

Function 00233BE2 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

p, xrefs: 00233C80
;z, xrefs: 00233C87
ss, xrefs: 00233C79
%*+(, xrefs: 00233EC4

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: %*+($;z$p$ss
API String ID: 0-2391135358
Opcode ID: e8ca53cd6df43f6eb55f51f1047c3b824642fcd6426b6735bc4964db237f5b8e
Instruction ID: c68847ff6adaf0e0e710a19fb2828ad9bbac0a7ece16bab6f1413e1bafe7beda
Opcode Fuzzy Hash: e8ca53cd6df43f6eb55f51f1047c3b824642fcd6426b6735bc4964db237f5b8e
Instruction Fuzzy Hash: E6026CB4820B00AFD760EF24D986756BFF4FF05300F90895DE89A8B655D370A569CF92

Function 00242260 Relevance: 5.4, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

a|, xrefs: 00242317
hu, xrefs: 0024232F
lc, xrefs: 00242507
sj, xrefs: 00242327

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: a|$hu$lc$sj
API String ID: 0-3748788050
Opcode ID: b2ed07b1a533607653537be2ce5afd442f17af468424c93a535c3981b5d54a7e
Instruction ID: cd29e0a5c001443e5db53677b59a2a9278725b64cfbb2245602fb14b3c0a98a5
Opcode Fuzzy Hash: b2ed07b1a533607653537be2ce5afd442f17af468424c93a535c3981b5d54a7e
Instruction Fuzzy Hash: F9A18970428341CBC324DF19C891A2AB7F4FF95354F948A0CF8D99B291E335D969CBA2

Function 0024D7AF Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

#', xrefs: 0024D9EA
KV, xrefs: 0024D97D
CV, xrefs: 0024D98B
T>, xrefs: 0024D984

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: #'$CV$KV$T>
API String ID: 0-95592268
Opcode ID: 4d88c77b5e094bbaa7294330cd621e6326fa6912b453b75df08b651cab23ca2a
Instruction ID: 4982b7ee9fb4b13ddee44f3ddadc4bfd07ff9c2803ed11d5d1ba518328165926
Opcode Fuzzy Hash: 4d88c77b5e094bbaa7294330cd621e6326fa6912b453b75df08b651cab23ca2a
Instruction Fuzzy Hash: F18157B48117459BDB20DF95D68516EBFB1FF12300F60460CE886ABA55C330AA65CFE6

Function 0024AC91 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

4c2a, xrefs: 0024ACA9
(g6e, xrefs: 0024ACA1
lk, xrefs: 0024ACBC
,{*y, xrefs: 0024AD07, 0024AD13

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: (g6e$,{*y$4c2a$lk
API String ID: 0-1327526056
Opcode ID: 8c0286b044439b3d43002737142a0c5d0825b926c8c4cceb6bb3453490a55527
Instruction ID: b3388e1b22e7190d6846b9289d5c70342fd6ce6dccd1cd00f62c27b4e78567f6
Opcode Fuzzy Hash: 8c0286b044439b3d43002737142a0c5d0825b926c8c4cceb6bb3453490a55527
Instruction Fuzzy Hash: 5941B5B4818382CBD7208F24D804BABB7F4FF86305F50995DE9C897220EB31D994CB96

Function 0024C470 Relevance: 4.2, Strings: 3, Instructions: 419COMMON

Download Yara Rule

Strings

~/i!, xrefs: 0024C537
%*+(, xrefs: 0024C9E4, 0024C9ED
%*+(, xrefs: 0024C8C3, 0024C8CB

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: %*+($%*+($~/i!
API String ID: 0-4033100838
Opcode ID: 63b8b6e04d3de8c3cd20afc1196162fc92f1965b28fd7a74625bc8dba18e7767
Instruction ID: 9994159a6527a6b5294cb588a285c0ef325fd1c9ab6c1ce9f71e5137ed5a3d6a
Opcode Fuzzy Hash: 63b8b6e04d3de8c3cd20afc1196162fc92f1965b28fd7a74625bc8dba18e7767
Instruction Fuzzy Hash: 17E198B1529340EFE3249F28E885B2BBBF9FB85344F54882CE58987251D731D864CF92

Function 003F60E8 Relevance: 4.1, Strings: 2, Instructions: 1645COMMON

Download Yara Rule

Strings

gH+}, xrefs: 003F6B91
jFvs, xrefs: 003F7187

Memory Dump Source

Source File: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: gH+}$jFvs
API String ID: 0-4208051141
Opcode ID: d063e4c5ac509cb6688f51678b511fb00ab8c723520913665f8a4379acc66e4c
Instruction ID: cc5faae9aeecff8f75bb25bd9493258c5226e6b4575599b4a61c21eb05bb8d0c
Opcode Fuzzy Hash: d063e4c5ac509cb6688f51678b511fb00ab8c723520913665f8a4379acc66e4c
Instruction Fuzzy Hash: 1AB218F360C200AFE304AE2DEC8567ABBE9EF94720F1A493DE6C5C7744E63558418697

Function 00228590 Relevance: 4.1, Strings: 3, Instructions: 387COMMON

Download Yara Rule

Strings

), xrefs: 0022860C
IEND, xrefs: 002289F0
), xrefs: 00228616

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: ce6df17307236390046aeca2447a47a2bc73c1e5bc94293b5bd4b02a0f7de87d
Instruction ID: 22499eac412fd153378da163f5753740cab14a3339f80e7e14cb64b3e9a57676
Opcode Fuzzy Hash: ce6df17307236390046aeca2447a47a2bc73c1e5bc94293b5bd4b02a0f7de87d
Instruction Fuzzy Hash: 70E1F3B1A18312AFE310CF68E84172ABBE4BF94314F14492DF59597381DBB5E964CBC2

Function 003EF6C5 Relevance: 4.1, Strings: 2, Instructions: 1573COMMON

Download Yara Rule

Strings

3?, xrefs: 003F032C
|l&, xrefs: 003EF9FB

Memory Dump Source

Source File: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: |l&$3?
API String ID: 0-200907424
Opcode ID: e7f38856c3465e0431b90bf5a24583fae03a7fea3f82755f65b68ffe98239dd9
Instruction ID: c799d2211c2d6a1294615b4f931f2102b1acdebe5cab69444f9dede975641789
Opcode Fuzzy Hash: e7f38856c3465e0431b90bf5a24583fae03a7fea3f82755f65b68ffe98239dd9
Instruction Fuzzy Hash: EAB2E6F3A0C2009FE314AE2DEC8577ABBE9EF94720F16893DE6C4C7744E63558058696

Function 00264040 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

%*+(, xrefs: 002640A4, 002640AD
f, xrefs: 0026420C

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: c099ef52d548bb0ab87e335b371e4f66fb85a9eadd940f8ee53c4c12cef88a47
Instruction ID: 7f8b4225261f0e6b2de1683e7563a25883a2dad1a0304030e134b84b46c434b5
Opcode Fuzzy Hash: c099ef52d548bb0ab87e335b371e4f66fb85a9eadd940f8ee53c4c12cef88a47
Instruction Fuzzy Hash: CB12BC715183418FC715DF18C880B2EBBE6FB8A314F588A6CF4D48B291D771E9A5CB92

Function 0025F620 Relevance: 3.0, Strings: 2, Instructions: 461COMMON

Download Yara Rule

Strings

dg, xrefs: 0025F7F5
hi, xrefs: 0025F6E6

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: dg$hi
API String ID: 0-2859417413
Opcode ID: b4f44cefa468419bde6867bfa7dc0bbde2f59be6ba012f5cf0a87a99fee8e48f
Instruction ID: 099e9f8b22fe320158308a407be44d933cb8c86024ba3459914e76815dc5bbab
Opcode Fuzzy Hash: b4f44cefa468419bde6867bfa7dc0bbde2f59be6ba012f5cf0a87a99fee8e48f
Instruction Fuzzy Hash: 60F1A771628342EFE304CF24D895B2ABBF5FB85345F14892CF4998B2A1C734D898CB56

Function 002235B0 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

NaN, xrefs: 0022360E
Inf, xrefs: 00223607

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: 07f48f116a9789c0490aa61d0209da7530e461ba1aa714b0d8b1f58b85064869
Instruction ID: d8eb4649314e9b1e159416522228979f981fb81aa8145949eb1de5fe9ea3d79f
Opcode Fuzzy Hash: 07f48f116a9789c0490aa61d0209da7530e461ba1aa714b0d8b1f58b85064869
Instruction Fuzzy Hash: 82D1F971A28322ABC704CF68D88061EB7E5FBC8750F14893DF99997390E775DD548B82

Function 0023FFDF Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

BaBc, xrefs: 00240197
Ye[g, xrefs: 002400F6

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: BaBc$Ye[g
API String ID: 0-286865133
Opcode ID: 7ef71dd3238c837b7f583beed0872be5b866d49864c153b0cc40c2e532eb436d
Instruction ID: e00866ebb337d3d82475d01e2df90b25c2c06f75e9e29698539b2e3af885e469
Opcode Fuzzy Hash: 7ef71dd3238c837b7f583beed0872be5b866d49864c153b0cc40c2e532eb436d
Instruction Fuzzy Hash: 4451BDB16283828BD339CF14C481BABB7E4FF96310F18591DE4DA8B651E3749990CB57

Function 00225160 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 002254C8

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 91212c512eaac4c8f78aac548b8ebc7e7a6b29e8603ab493d11fe59163a2f5b7
Instruction ID: 5f37605bb6866b2fe8423a882e332ac1efb30ae07d4df47b028304c9a3a5dd4f
Opcode Fuzzy Hash: 91212c512eaac4c8f78aac548b8ebc7e7a6b29e8603ab493d11fe59163a2f5b7
Instruction Fuzzy Hash: A822D5B2928B72ABE7158E98E440336FBE2AFE0304F19C56DD8594B341E7B5DC64C742

Function 002512D0 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 002515D1

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction ID: 2e11aed242648a084d0dc2dbbee77ceb0127a113dc70a02b27719d4d21972788
Opcode Fuzzy Hash: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction Fuzzy Hash: 89F14571A183425BC724CE28C49172BBBE5AFC5355F1C856DEC9A87382D634DC28CB96

Function 0024AE57 Relevance: 1.7, Strings: 1, Instructions: 455COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0024B2D3, 0024B2DB

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 1cde7d67a2993c38128c33caec87f20a8a1a016c0e8b912f5a753382c095b354
Instruction ID: c11b8d9f8192e62480c76150bb9d07e07c929cbe17eaee30686d2553f2ce5f79
Opcode Fuzzy Hash: 1cde7d67a2993c38128c33caec87f20a8a1a016c0e8b912f5a753382c095b354
Instruction Fuzzy Hash: D3E19A71528306CBC719DF29D49056AB7F2FF98781F55891CE8C987260E331E9A9CB82

Function 00236EBF Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00236EF3

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 894ccb0cc29654f64b05a029cd72d7b127fc7390936682c818b8d12f87e98215
Instruction ID: 1f05c21a740a55d77ffe68f6577a8ac952ef1eefebf81bddb9d2ede5d07c9ef1
Opcode Fuzzy Hash: 894ccb0cc29654f64b05a029cd72d7b127fc7390936682c818b8d12f87e98215
Instruction Fuzzy Hash: 59F1AEB5620701DFC724DF24E995A26B3FAFF48314B248A2DD49787A91EB74F825CB40

Function 00247E60 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00248263, 0024826B

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 2d5ed5f6f64bc04185e6ff75be5c673a843e3d19133015545a7acc3442d845af
Instruction ID: d09c24ba4ad1f5e973a78b57759a44513d11c5a8292746a83d31fe964277ed6f
Opcode Fuzzy Hash: 2d5ed5f6f64bc04185e6ff75be5c673a843e3d19133015545a7acc3442d845af
Instruction Fuzzy Hash: EBC1EE71528201ABD714EF14C882A2FB7F5EF95754F088819F8C98B252E734EC65CBA2

Function 00248D62 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00249233, 0024923B

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: db595de0e7dbecbc96e261da9412b7bcab2799064e441533b1ce1e0255d1ce5e
Instruction ID: d67b304bb7c995268df259b3a658530f0a5ecb9ced3aa5097e4327d005745d75
Opcode Fuzzy Hash: db595de0e7dbecbc96e261da9412b7bcab2799064e441533b1ce1e0255d1ce5e
Instruction Fuzzy Hash: 7DD1D170628302DFD718DF64EC94A2AB7E5FF89304F49486CE88AC7291D735E994CB51

Function 00234487 Relevance: 1.6, Strings: 1, Instructions: 389COMMON

Download Yara Rule

Strings

BI#, xrefs: 0023485E

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: BI#
API String ID: 0-260244866
Opcode ID: b846dd978a84fc3b91e0ad20d275c43dfde5fcb317d5ff4295ddc356eb51c854
Instruction ID: 815205ee8f56862d45bafa98e657109017cef6bce61d020fb63ee7aa45a0f0be
Opcode Fuzzy Hash: b846dd978a84fc3b91e0ad20d275c43dfde5fcb317d5ff4295ddc356eb51c854
Instruction Fuzzy Hash: 37E110B5510B008FD361DF28E996B97B7E1FF0A708F04886DE4AAC7752D775B8208B14

Function 00267FC0 Relevance: 1.6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

P, xrefs: 00268167

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 2333faedb490df16898675e74e7e242fbfe04f7b2c54c99ede642b22b11b6e92
Instruction ID: 50d81067230d6427c6651c1132de799a3ec73e124ed01680a1ff714890c660df
Opcode Fuzzy Hash: 2333faedb490df16898675e74e7e242fbfe04f7b2c54c99ede642b22b11b6e92
Instruction Fuzzy Hash: E2D1E4729182758FC725CE18D89072FB7E1EB85718F158A2CE9A5AB380CB71DC96C7C1

Function 00266CBF Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

"p&, xrefs: 00267015

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: "p&
API String ID: 0-968538007
Opcode ID: c431390cae5ea93b62d91c20a2816b6ea487faf68ca4e377226c27b712eabde3
Instruction ID: ed498670322da334bf930c4e40beffd59c2627abc729a034d17462be12064094
Opcode Fuzzy Hash: c431390cae5ea93b62d91c20a2816b6ea487faf68ca4e377226c27b712eabde3
Instruction Fuzzy Hash: 3AD1F136618351CFC715CF38E88452AF7E2AB89314F098A6DE899C73A1D335DA84CB91

Function 00521E94 Relevance: 1.6, Strings: 1, Instructions: 374COMMON

Download Yara Rule

Strings

1Hw], xrefs: 0052217C

Memory Dump Source

Source File: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: 1Hw]
API String ID: 0-1660837592
Opcode ID: 8b437b7b108d867fcc2adb456d488c9cdbaeda9145fcfa05c28db98d93d4b9b9
Instruction ID: a15cbba0b97e7b62ec34fb25ef0bac288666b30439fe818a0719f62a977dbbe8
Opcode Fuzzy Hash: 8b437b7b108d867fcc2adb456d488c9cdbaeda9145fcfa05c28db98d93d4b9b9
Instruction Fuzzy Hash: 8CB16AB3A08214AFE7149E2DECC076677DAEFD4320F29853DE985D7784D63A5C058292

Function 0024CCD0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0024CDC3, 0024CDCB

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+(
API String ID: 2994545307-3233224373
Opcode ID: c27c41ea9cc38c28538de0ef827b4cb5717bfd0f2942d2fa02790f791a49b294
Instruction ID: ecf5600e260fa87d57e6b1206455a0038aab3efe6c0fd0e8299732a23f6e638a
Opcode Fuzzy Hash: c27c41ea9cc38c28538de0ef827b4cb5717bfd0f2942d2fa02790f791a49b294
Instruction Fuzzy Hash: 02B10170A2A3029BD718DF58D881B2BFBE6EF85344F24482CE5C58B351E375D865CB92

Function 0022A850 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

,, xrefs: 0022A9C3

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction ID: f8e0789654106c961aec5d8856e654d7e2f13d0a9405b4dcc77f1a7e86a2f919
Opcode Fuzzy Hash: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction Fuzzy Hash: 81B138702083819FC320CF59D88061BBBE1AFA9704F448A2DF5D997742D671EA58CBA7

Function 0025FC20 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0025FCA4, 0025FCAD

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 2621fa6a18492a96adb884b1a7b0b699bd134668edcb1de6d20e451d84b357f0
Instruction ID: 0109bf4326cb0a0b7dafae9181aaebbdb14f838413b13af85e69c10903b4e8c9
Opcode Fuzzy Hash: 2621fa6a18492a96adb884b1a7b0b699bd134668edcb1de6d20e451d84b357f0
Instruction Fuzzy Hash: 5A81FE70529301EBD714DF64EA85B2AB7F5FB89702F04882CF9C987291D771D868CB62

Function 0023D457 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0023D663, 0023D66B

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 5c44848b02c06d703c15cf2d0dd98a45f5a666a95e7275136c9df3fbe0a79e0a
Instruction ID: 51f65cdd4c109881a8f76ab3dfa0c46c27b2c595a65f7133e864bb7d6e082d37
Opcode Fuzzy Hash: 5c44848b02c06d703c15cf2d0dd98a45f5a666a95e7275136c9df3fbe0a79e0a
Instruction Fuzzy Hash: 3861E4B2924315DBD710EF58FC82A2AB3B4FF94354F44082CF9898B251E771E964CB92

Function 00264A40 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00264C33, 00264C3B

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 00fa622f9ecade85a3b479ddc81560b9e821d707a8fc93a08dcaf3101ad8d1f6
Instruction ID: 2a1ba3f25667dc2ff3dc6328e8003a3f844a269c04c175d658fd1c5ddd14140e
Opcode Fuzzy Hash: 00fa622f9ecade85a3b479ddc81560b9e821d707a8fc93a08dcaf3101ad8d1f6
Instruction Fuzzy Hash: 8561EF71A283429BD714EF15D880B2AFBE6EBC5318F18891DE5C887291C672ECA0CB51

Function 0022E1A0 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 0022E333

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: c24dfecb6288c9aa65e8c2569be33fe790bf921214d64413a45e6ba659945ac9
Instruction ID: 3f0dd440a01cbdb9a6359ca252cce6cf78e703b5f864b7a587d5bfcaf7247cd5
Opcode Fuzzy Hash: c24dfecb6288c9aa65e8c2569be33fe790bf921214d64413a45e6ba659945ac9
Instruction Fuzzy Hash: 7F518A23B386A087C724D97D6C553B97A870FA2330B3FC3A9E8F2873E0D19548106390

Function 00263920 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 002639E3, 002639EB

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 53b031c91707df5f98fc4edd0c7ad07a6f9f05cf602b08fb0a5fadd5f38d93f1
Instruction ID: c59fca375f2be7646cd9fdcd03ad1f4c78a9f82b5bdd5265d8dc616c2bc96bcf
Opcode Fuzzy Hash: 53b031c91707df5f98fc4edd0c7ad07a6f9f05cf602b08fb0a5fadd5f38d93f1
Instruction Fuzzy Hash: 5851BF70629201DBCB28DF54D984A2AFBF5FF85704F14881CE4CA87251C771DEA0DB62

Function 00231BEE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 00231C3E

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: 991f8dbdf24ba119a94dfb45e442eddbfd93e5e150110ab0e291689fc9cb354e
Instruction ID: a9d5bd4130040dccd174d377626a7656359483c701afe7a4f4d572a36b62b6f8
Opcode Fuzzy Hash: 991f8dbdf24ba119a94dfb45e442eddbfd93e5e150110ab0e291689fc9cb354e
Instruction Fuzzy Hash: 9F4161B40183819BC714AF24E894A2BBBF0BF86314F049D0DF5C99B290D736C9258B57

Function 0025FF70 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00260033, 0026003B

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 714f0b021cd79b0794512ce4ad42c8969d77e830a164afc1c48a3977e08ae50e
Instruction ID: 149b7044baef0b95ad8f92f31561e9afbc45a2608bf0580a60a6c06e6b26a0b3
Opcode Fuzzy Hash: 714f0b021cd79b0794512ce4ad42c8969d77e830a164afc1c48a3977e08ae50e
Instruction Fuzzy Hash: F831E5B1928311ABD610EE54DC81F2BB7E8EB85744F544828F88597252E332DCB4DBA3

Function 0024E40C Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

72?1, xrefs: 0024E6A2

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 94b87b7f5956868c9fea9b867a2cd1b288a09446da699778806dc255df9bcc66
Instruction ID: 0025edb710bb6f01f296ebd1d2d7f389dfcefd37ecd99b8f40d20f6b579f4cdc
Opcode Fuzzy Hash: 94b87b7f5956868c9fea9b867a2cd1b288a09446da699778806dc255df9bcc66
Instruction Fuzzy Hash: B431F2B5920205CFEB24CF98E8805AFF7B4FF1A715F240428E54AA7301C335A965CBA2

Function 00236F91 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0023703B

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 931b32c9d86270587bfb4031f7f0302906116ba6dd553bb303989e6138464294
Instruction ID: 615923bbce8019e2242c16eda1a406af99f97ef579a842ab81ae68ec1be6d3f1
Opcode Fuzzy Hash: 931b32c9d86270587bfb4031f7f0302906116ba6dd553bb303989e6138464294
Instruction Fuzzy Hash: BF415BB1224B05DBDB388F61D994B27B7F2FB09701F148818E58A9BA61E371F8208B10

Function 0024E66A Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

72?1, xrefs: 0024E6A2

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 40a9981d77856998017f58ed72042da040c36a95da99efb85626099a317daabc
Instruction ID: 7e9da97f086547fd5064219e41f00bf369b71fab82f115b025e20108376615c7
Opcode Fuzzy Hash: 40a9981d77856998017f58ed72042da040c36a95da99efb85626099a317daabc
Instruction Fuzzy Hash: F621E5B1910205CFDB24CF99E88456FFBB5BF1A701F15081CD546A7301C335AD61CBA2

Function 00269CE0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 00269D30

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 67261a8db2f7bb6dbd050db9ecd0f3cd9e29af0ecaa341ea7a9892cadff0352e
Instruction ID: d0ea293e42a7913e269e72ced56dfded03a4d7d36058245d82508d3c087a9e2a
Opcode Fuzzy Hash: 67261a8db2f7bb6dbd050db9ecd0f3cd9e29af0ecaa341ea7a9892cadff0352e
Instruction Fuzzy Hash: 1031B8709183018BD314EF14D880A2BFBF9FF9A358F14892CE1C897251D776D894CBA6

Function 00234E2A Relevance: 1.0, Instructions: 957COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a1e3903be474e79944df9e834f942684ac9035429aae675f0959f9ea261686c
Instruction ID: 044e297e32f924e2b5ee5f3833c5590730180d0f16ccbea0eb16d2cd2166ab46
Opcode Fuzzy Hash: 0a1e3903be474e79944df9e834f942684ac9035429aae675f0959f9ea261686c
Instruction Fuzzy Hash: 8E6268B0620B118FD735CF24D981B27B7F6AF49700F54896CD49A8BA52E774F828CB90

Function 0022BEB0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction ID: 91da7d17498984a80685f60c8ab6581d02b3f0d16ee71dd8a3a9923c2c3b4743
Opcode Fuzzy Hash: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction Fuzzy Hash: B95209319287229BC7259F58E4402BEF3E1FFD4319F358A2DD9C693290D774A861CB86

Function 00268652 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 409acbc25d394ee23c4187196d6c441a37022361cb23ea70b15b9a04433bad13
Instruction ID: 5a3b9ef7c7125c3e29816580d76ddc9f483efa695759b4d9b9a30bd7fd535aa5
Opcode Fuzzy Hash: 409acbc25d394ee23c4187196d6c441a37022361cb23ea70b15b9a04433bad13
Instruction Fuzzy Hash: D722EC35618341CFC704EF68E89462AB7F5FF8A315F59896DE98987361C731D8A0CB42

Function 002686F0 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1e0291d251cd134c8ef2bf10183154a2cc531407b5cc7d169d4682d6954503e
Instruction ID: ea1c9efa9c3f854dd1f70335bd3e3552a3fcdb1bd776d44b80c9b4ce43fcf348
Opcode Fuzzy Hash: b1e0291d251cd134c8ef2bf10183154a2cc531407b5cc7d169d4682d6954503e
Instruction Fuzzy Hash: E022BB35618341DFC704EF68E89462ABBE5FF8A305F19896DE98987361C735D8A0CB42

Function 0022B3A0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ccb997c0e1f3bea77c4b92f794733f5d68737a75237877998288b9c0bcaa23e
Instruction ID: 36f3fa9c6c3e4032936d721e77faaa8288af0b911ff593001e0d38de56273c39
Opcode Fuzzy Hash: 9ccb997c0e1f3bea77c4b92f794733f5d68737a75237877998288b9c0bcaa23e
Instruction Fuzzy Hash: FC52E670918B95AFE736CF64D0843A7BBE2AF95314F144C2EC5D60AB82C779A894CB41

Function 002271F0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1cd82948168ce43fe3a7ef8dd7c53eb891f9a327f0f86c0e1124f537fa67b4d
Instruction ID: c467d1d11877740279f803f42ae175b3ace90b51b9043ba3e55e69c4adaa52fd
Opcode Fuzzy Hash: c1cd82948168ce43fe3a7ef8dd7c53eb891f9a327f0f86c0e1124f537fa67b4d
Instruction Fuzzy Hash: F852113151C3669FCB14CF68D0806AABBE1BF88314F188A6DF8995B341D774E899CB81

Function 00228FD0 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2103249552adf3ce8d8fa4bfcb0a9ca6e1b9eb742b350f930948838fcec9abd0
Instruction ID: 53a9e038a86b3e32c2409b3788a49938c7c6bd0e8ca7185765cbab260330c7eb
Opcode Fuzzy Hash: 2103249552adf3ce8d8fa4bfcb0a9ca6e1b9eb742b350f930948838fcec9abd0
Instruction Fuzzy Hash: A2427879618301DFDB04CF28E85476ABBE1BF88315F0A886CE4858B391D7B5D995CF82

Function 00227BF0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f58954ce32a7f8e48ec433fe3c3dcfe9f3b4a8dd42205e6941408a7d741c8c10
Instruction ID: 0ce06836f92853ff234ea3a86d7d3b995c554c95510d36c9470eb2f97b4d9e13
Opcode Fuzzy Hash: f58954ce32a7f8e48ec433fe3c3dcfe9f3b4a8dd42205e6941408a7d741c8c10
Instruction Fuzzy Hash: E9324270529B219FC338CEA9D690626B7F1BF45700BA04A2ED6A787F90D776F854CB10

Function 002689A0 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0aa5a376b06c86f5cb54b0ecb0ddc7749427d0d384048a2ea8ea621c984883f
Instruction ID: 119cb2317701457b13e4d53d8614d330ae8a75b9c952ac4ddaaf8be65d9813f6
Opcode Fuzzy Hash: c0aa5a376b06c86f5cb54b0ecb0ddc7749427d0d384048a2ea8ea621c984883f
Instruction Fuzzy Hash: 5102BC34618341DFC704EF68E88461AFBE5EF8A305F19896DE9C987361C735D9A0CB92

Function 00268A80 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07eabf18a898c7370daba720f5dc251b0d1e448401671f4005157ca9f6ca8334
Instruction ID: 389dda08679dcf34b4b81b7f4a39adf7a5ab562cd1d5f5ad872f70c3e39dded7
Opcode Fuzzy Hash: 07eabf18a898c7370daba720f5dc251b0d1e448401671f4005157ca9f6ca8334
Instruction Fuzzy Hash: 08F1AC3061C341DFC704EF28E88461AFBE5EF8A305F19896DE9C987251D736D9A0CB92

Function 00268C02 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1296fcb63d5388730b05e24ed02ec943ee749973bdb7c9343ce1ddf5439a8036
Instruction ID: 7db7d05b56ed5237293c90c9af1253b82759bf04b8c2af0d91a28556fa258a57
Opcode Fuzzy Hash: 1296fcb63d5388730b05e24ed02ec943ee749973bdb7c9343ce1ddf5439a8036
Instruction Fuzzy Hash: A0E1DF3161C341CFC704EF28E89462AF7E5EB8A315F19896CE9C987352D735D9A0CB92

Function 0022A300 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction ID: 774db787a2adac82098ec93f2a0f17fa45a2b6137777c64d1787b0199026808a
Opcode Fuzzy Hash: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction Fuzzy Hash: E9F1CC766083419FC724CF69C88176BFBE6AFD8300F08882DE4C587751E639E959CB92

Function 00268E70 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d05a7ae139237e05539f11c855cfff19f28d7472b1fb829e4a34f246b1db5a33
Instruction ID: 2bcb77cce92f32102f0081d9c353af85a2700f2da2fa917e418838870f2796f6
Opcode Fuzzy Hash: d05a7ae139237e05539f11c855cfff19f28d7472b1fb829e4a34f246b1db5a33
Instruction Fuzzy Hash: 60D1C03061C241DFD704EF28E89462EFBF5EB8A305F18896DE4C987252D736D8A0CB52

Function 00267AB0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04c43a9fbb1fcf0883de831d0ae25f7828514f100f1a2f4dce4efb9f4f617c0c
Instruction ID: 0faf69af4f2b25b3f5ea695e4ceb0c82b7512b1c65de962a5be51d3a3478a46f
Opcode Fuzzy Hash: 04c43a9fbb1fcf0883de831d0ae25f7828514f100f1a2f4dce4efb9f4f617c0c
Instruction Fuzzy Hash: 5AB11772A2C3505BE314DE28EC4176BB7E5EFC4318F08492DE99997381E735DC548B92

Function 0022AF10 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction ID: 97a1c2441967c1873b0cc601593f0d02f6fda8d72d498119c5ba8b4164c6ab6f
Opcode Fuzzy Hash: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction Fuzzy Hash: C3C1AEB2A187419FC330CF68DC967ABB7E1BF85318F08492CD1D9C6202E778A165CB46

Function 00236536 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aac80ac55be07a539432a3f820335d584e53c020b21b79693699f3d82f5141b3
Instruction ID: dba2ef1ff932b2f99c18854664277cd53a60d5430daee3a96bdc326de2cb9605
Opcode Fuzzy Hash: aac80ac55be07a539432a3f820335d584e53c020b21b79693699f3d82f5141b3
Instruction Fuzzy Hash: D8B11FB4610B009BC321CF24D985B27BBF9EF4A704F54885CE8AA9BA52E375F815CB54

Function 00267710 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e586981e22001a4a34eefc9a7e87afa6e442682544a213d4f2c82f04b58c419d
Instruction ID: 7bfc831f891917b00916c611b8c97ced7a319f4b32c81f506e4afc53096c8ff8
Opcode Fuzzy Hash: e586981e22001a4a34eefc9a7e87afa6e442682544a213d4f2c82f04b58c419d
Instruction Fuzzy Hash: 2391A07162C301ABE720CF14E880B6FB7E5EB85358F54481CF89987391E730E9A0CB92

Function 0026A0D0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa87a75e19148558fe9e488a5fbda1a91f524b829b8fa1361be3f87854ee47da
Instruction ID: 4b98ae66068125bea8919bed8eb168d6ebb195f6ff34aa1936bf4823b9b4d279
Opcode Fuzzy Hash: aa87a75e19148558fe9e488a5fbda1a91f524b829b8fa1361be3f87854ee47da
Instruction Fuzzy Hash: 7C819E342187028BD724DF28D890A2AB7F5FF89740F55896CE9859B351E731ECA0CB92

Function 002564F0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13456cbc18bfa992330be9df3e69a5aa5d1e49a5cb2f268b4b5a6fe44a95f779
Instruction ID: b086e3285a271447b626de4b6efe3c72de0d71cf2adb2252a35fd1a949bfa8b2
Opcode Fuzzy Hash: 13456cbc18bfa992330be9df3e69a5aa5d1e49a5cb2f268b4b5a6fe44a95f779
Instruction Fuzzy Hash: E171E533B79A904BC3249D3C5C8A3A5AA474BD6334B7DC379E8B48B3E5D5B94C1A4384

Function 002428E9 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e96ab3531e38892db19472f02f91e1050f180a434656d9fec7cc7a05dcfea72
Instruction ID: 063a9bd044acd5e5c201b2a70898e3961a721293a8b602dfa4b3440b93753332
Opcode Fuzzy Hash: 0e96ab3531e38892db19472f02f91e1050f180a434656d9fec7cc7a05dcfea72
Instruction Fuzzy Hash: 2361A8B0428350DBD314AF19E891A2ABBF4FF96750F44490CF4C58B261E379D924CB67

Function 00247C00 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08e82c0691b740a300354f5f149502a8aba92e32cea3b55d61e4588e3ee050ab
Instruction ID: 2520ed9ef31dd0c323b1af2e02138c1aa2e2da6b8e3c63d2dc2d28efc42868c7
Opcode Fuzzy Hash: 08e82c0691b740a300354f5f149502a8aba92e32cea3b55d61e4588e3ee050ab
Instruction Fuzzy Hash: 4551E0B0A28205ABDB289F24CC82B7733B4EF86758F144958F9968B390F375DC10C761

Function 00251860 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction ID: 8d4b726ea53a16dec7244b54f82db7de3018e5212d4047e03b7d99159b4c1ae2
Opcode Fuzzy Hash: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction Fuzzy Hash: 8961F4316293029BD715CE28C58471FBBE2ABC5352F64C92DF8898B351D2B0DC69D749

Function 002582D0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27d8cf5c5239fb662d9757a99e5f593fa6f581046d2b04709ab85cd4eb97447d
Instruction ID: 1f5accf60c50c0be733c7c505fc75dad30f4f4ddab88c97075061acb92f701a0
Opcode Fuzzy Hash: 27d8cf5c5239fb662d9757a99e5f593fa6f581046d2b04709ab85cd4eb97447d
Instruction Fuzzy Hash: 5C613423A3A9914BD315453D1C463A6AA831BD2331F3EC3A5DCF2AB3E4DDF988194345

Function 002342FC Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49386101ea6a492a1230856eb6d570f66d718f964e2fd5960ca378b7b4f555d8
Instruction ID: a9f1f31b9ab9a65d2a4687ea83cdf33011cf00e8d56ecb26efbd3ee7c5df4a02
Opcode Fuzzy Hash: 49386101ea6a492a1230856eb6d570f66d718f964e2fd5960ca378b7b4f555d8
Instruction Fuzzy Hash: 3C81E2B4820B00AFD360EF39D947757BEF4AB06201F504A1DE4EA96694E7306429CFE3

Function 0029E52D Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cecf626cf7feeaf8f9221405737f1bdcfd65dac3534bdf740bc851525bde3cf0
Instruction ID: f0dcbc67dd8696d17d011f9a0b7193f858aca9c6fe7315ffdc55763b605977f5
Opcode Fuzzy Hash: cecf626cf7feeaf8f9221405737f1bdcfd65dac3534bdf740bc851525bde3cf0
Instruction Fuzzy Hash: C75155F3A092105BE3509A6DDC847ABBBDADFC4320F2A453DEAC4D3B44E8715C0182D5

Function 0025E8A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction ID: 31bb494b67f525e052e5050f9fc572c5968e9fd52f42afb97009eca4274eecbf
Opcode Fuzzy Hash: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction Fuzzy Hash: 4A516BB16083548FE714DF69D49435BBBE1BB85318F054E2DE4E987350E379DA088B86

Function 0036CCC1 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 674acafbddaceae3605193e71041dacbb200070182bb18855193aae8bdd3b0a1
Instruction ID: 464a9946e0228cbf94db6bf3695518c1e6b6da395a3f0361bb8ee964cbe66f08
Opcode Fuzzy Hash: 674acafbddaceae3605193e71041dacbb200070182bb18855193aae8bdd3b0a1
Instruction Fuzzy Hash: 0B5105B3F082105BF7085929DC987BAB6D7DBD4321F1B813DEB8997784ED7848058686

Function 00267520 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62fb6331c4f236ba3e90579e1e7abe1e46666b3ffbbf12f11bd64184198ff3b5
Instruction ID: ad2027093e8565b2e2ecc42affb1c09ef5866d01ffa34d6c922ff6169daec9e6
Opcode Fuzzy Hash: 62fb6331c4f236ba3e90579e1e7abe1e46666b3ffbbf12f11bd64184198ff3b5
Instruction Fuzzy Hash: 00512C7162C2119BC7159E18EC90B2EF7E5FB8531CF288A2CE8D957391D731EC608791

Function 004DD917 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df1e7e1a1e20c2658009139b87b0d80106595b5419f2d466593d73f01bb9639d
Instruction ID: 34c7e3f453422442743918606faae79fbd054bdcb72793719edb944b07ecdbc1
Opcode Fuzzy Hash: df1e7e1a1e20c2658009139b87b0d80106595b5419f2d466593d73f01bb9639d
Instruction Fuzzy Hash: 4351F6F3D0C200EFD308AE28DCA563AB7E4EB54350F25863FE5C6C2304D6795801965B

Function 00342769 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7890ef62ac8b5fb411bffff2805ba49f839232efc1b4d64b5a5f88d5530ab31d
Instruction ID: 17ee2f6549414b78ba0b22db3ae85642c3ed01f6bd6864d982bf52f76d848942
Opcode Fuzzy Hash: 7890ef62ac8b5fb411bffff2805ba49f839232efc1b4d64b5a5f88d5530ab31d
Instruction Fuzzy Hash: 82510AF3A185109BE3186A2CEC5577A77E5EFD4310F1A853DDAD4C7380EE3948058696

Function 00225A50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ac850d841c1976442ff7077200cc112d8d61a200100f0e48d09130b505ebc62
Instruction ID: 94378578e7efeeac8ca9164023959e0ba4e0f3686fc56bb2e9f0417a1720a5f2
Opcode Fuzzy Hash: 9ac850d841c1976442ff7077200cc112d8d61a200100f0e48d09130b505ebc62
Instruction Fuzzy Hash: 4C510771914735AFC714DF94E88192AB7A0FF89328F15866CF8958B352D730EC62CB91

Function 003DAEE9 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91f1e6601805b51456f87155e42531f2e3f86ff9b9bfbefa2b1d8452a9510dc0
Instruction ID: da0dbbccc75e2c3b70798a5d1d6fa28ce4368aa0cb7229aefd0506588ab9c722
Opcode Fuzzy Hash: 91f1e6601805b51456f87155e42531f2e3f86ff9b9bfbefa2b1d8452a9510dc0
Instruction Fuzzy Hash: 284192F250C604AFE314AE19DC857BFB7D5EB98320F06893DDBC483B44E63998458796

Function 0024EC48 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c079a10fc774b84f8611cba952a87fbc5b30728183d54fc16655da04cb31ee74
Instruction ID: c8dfddd871aa408eb2f3f814a1696cef839c32e8a7de2d40c3fcf3602a38750b
Opcode Fuzzy Hash: c079a10fc774b84f8611cba952a87fbc5b30728183d54fc16655da04cb31ee74
Instruction Fuzzy Hash: 94419E74D10326DBDF248F94DC91BADB7B0FF0A340F144549E945AB3A0EB38A961CB91

Function 00269B60 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbec963077815c5914d72ab184aa377fbd7ba6bd61f24be538182224a02cff91
Instruction ID: 99b392271c03efe313bdedab4780698f1ac4e88eefb054c20af6e6e64fab2102
Opcode Fuzzy Hash: fbec963077815c5914d72ab184aa377fbd7ba6bd61f24be538182224a02cff91
Instruction Fuzzy Hash: 2B419D34628301ABD714DF14D990B2BF7EAEB89714F14882DF58997251DB71E8E0CBA2

Function 00232030 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3496460652a6cbc4ff238a1700c5bcc69df982960033a6611c09901f31cbeb7b
Instruction ID: fa89b1acc16f90886b4f7e6c02742ea10a7092723a636fb76dc04c36ee19117c
Opcode Fuzzy Hash: 3496460652a6cbc4ff238a1700c5bcc69df982960033a6611c09901f31cbeb7b
Instruction Fuzzy Hash: 27410772A1C3654FD35CCE2984A063ABBE2AFC4300F19C62EE4D6873D1DAB48959D781

Function 00231E93 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af525579f526fc7b48f69c39a0c39008040fab1c619d41be7d9afa5f6c917a22
Instruction ID: ce49f3369158dfa832d3933bf97d7694fd318593db17a4e48806df5892c45b89
Opcode Fuzzy Hash: af525579f526fc7b48f69c39a0c39008040fab1c619d41be7d9afa5f6c917a22
Instruction Fuzzy Hash: 07410FB45183809BC320AB59D888B1EFBF5FB86745F144D1DF6C497292C376E8248F66

Function 00268D8A Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5375f939f1c17020d1507f364116447ad8ebc5ffb7bf6aa2b9eeb649d776a96
Instruction ID: 5958eec56ab52a26d10add601c57b7d449e76b709a3e9ab045a07b23616200bc
Opcode Fuzzy Hash: a5375f939f1c17020d1507f364116447ad8ebc5ffb7bf6aa2b9eeb649d776a96
Instruction Fuzzy Hash: 2441F03161D2518FC304EF68C49062EFBE6AF9A300F198B2ED4D5E72A1DB74DD518B92

Function 0023D961 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151d1cfab1d59ea0a8ee9ddff971176971e1dfe047d2b029fdaf2cf61d6149e4
Instruction ID: 754edef3315eb40be60098eef9e51a0b735d9d3e8130f0462e9cc48811545583
Opcode Fuzzy Hash: 151d1cfab1d59ea0a8ee9ddff971176971e1dfe047d2b029fdaf2cf61d6149e4
Instruction Fuzzy Hash: F241BDB1618381CBD3309F14E895BAFB7B0FF96360F040958E48A8B791E7744960DB97

Function 004EB39A Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18788975b883b287f156b74a00b1339b435796512b0e05936c800f0527f68d84
Instruction ID: a977664eb0241bba4957621a059e3c1392ec3ab60f57c5af79a54693952ad226
Opcode Fuzzy Hash: 18788975b883b287f156b74a00b1339b435796512b0e05936c800f0527f68d84
Instruction Fuzzy Hash: 0D319EB390C620AFE305AF19D8816AAF7E5EF98311F17892DDAC4D3354EA7058408BC6

Function 0025F030 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction ID: 69a09441fa5257fa5d690b2353ae2fe370248a97602746a776b7a0850b56695d
Opcode Fuzzy Hash: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction Fuzzy Hash: 582137329182254BC3249F19C58063BF7E8EB99705F0AC63EDDC4A7295E335DC2887E5

Function 002667EF Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7d5a4eee3dd72537d48818494e332044afdf77cb55755465c608c676d5714f9
Instruction ID: 990cde84bf8f3a66ed189478acd58de638871c199aa65028ba679179c1b97edc
Opcode Fuzzy Hash: c7d5a4eee3dd72537d48818494e332044afdf77cb55755465c608c676d5714f9
Instruction Fuzzy Hash: 563134705283829AD714CF14C49462FBBF0EF96388F54580CF4C8AB261D338D999CB9A

Function 00245E70 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1066fce94747b67f1c0b2e130bc4aeae67f34ac22945ebc8f35d90b6ef3f4e26
Instruction ID: d0f8a102c795f3284a61f6f1f8207f2c2e5d6436307d4d0af77cee66819dfcda
Opcode Fuzzy Hash: 1066fce94747b67f1c0b2e130bc4aeae67f34ac22945ebc8f35d90b6ef3f4e26
Instruction Fuzzy Hash: C021B270528221DBC314AF18C84192BB7F8EF92764F55890CF4D99B692E334CD64CBA3

Function 002249A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction ID: ed72d7e511073ee4742207bf7fd001e3e6e15f76e63385f155e74cd5d92cfa1b
Opcode Fuzzy Hash: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction Fuzzy Hash: 3131F031668221AFD710EE98F89162BB7E1EFC8358F14852DE899C7241D375DC62CF45

Function 002664B8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 435c9f4ef39f01574a68568bc300c3ab25ae6b702804b38880d5bf4a912e8dd8
Instruction ID: 3ba6c320ff04510eeda60525cb9f8e9f29158e4d1be344771b43039544d0cfdc
Opcode Fuzzy Hash: 435c9f4ef39f01574a68568bc300c3ab25ae6b702804b38880d5bf4a912e8dd8
Instruction Fuzzy Hash: 6A214C7052C241DBC714EF19E584A2EF7F5FB95745F18881CE4C593361C735A8A0DBA2

Function 0025B650 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: dcc612731bf0aa8af2fe780644b5f162969c5b0a9a0dfd0640582b52934f7240
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: AD11E933A151D54EC3178D3C8440565BFA71AA3236F594399F8B49B2D2D7328D8E8358

Function 00250B80 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction ID: becd2a9d5d7452be225315999138c7567372fd3452f77331c0d50cd7c0963065
Opcode Fuzzy Hash: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction Fuzzy Hash: A70171F5A2030357E7209E54A8D1B3BB2A86F8571DF18452CEC0657202DB75EC29CA99

Function 0024D1E1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb51324f6043497fe5255a5f4c238f15805910d434a42edae2400598938be5d5
Instruction ID: c9acc0bf64c754ad88d4f8bed5f44aae565b50a4bfee9e5a5e81b0e59f5215b4
Opcode Fuzzy Hash: cb51324f6043497fe5255a5f4c238f15805910d434a42edae2400598938be5d5
Instruction Fuzzy Hash: 9B11DDB0418380AFD310EF618484A1FFBE5ABA6714F148C0DF5A45B251C375D859CF56

Function 00226EA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c60713b2dde8343168e8e5d9e489e55c0ff4dc2c62d2b33e34cd1c8e5f09ff07
Instruction ID: 5c4e3fbccc81327e9697f505e9796a88028b450c360d7dc62db399d63d113c8b
Opcode Fuzzy Hash: c60713b2dde8343168e8e5d9e489e55c0ff4dc2c62d2b33e34cd1c8e5f09ff07
Instruction Fuzzy Hash: 89F0593F72822A1FA611CDEAF88883BF3D6D7D9354B045539EE41C3605CDB2E81281D0

Function 0025B8C0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction ID: 6506d07c58c905065930edc77b6421f51c28c54387ea28b09faa2761b04cb969
Opcode Fuzzy Hash: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction Fuzzy Hash: 1E0162B3A199610B8348CE3DDC1156BBAD15BD5770F19872DBEF5CB3E0D230C8118695

Function 0023C5F0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 0023B410 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: 020fe716b639c8f9d704f4c5937a1bd2b73a746e33979dcdccb3bd628fac14a3
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: 7DF0ECF1A1451057DF238E549CD0F37BB9CCB97354F190427EB8557103D2619859C3E9

Function 00258220 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d98dab16672489129bf6f5149003e248d0b49a997adcb1bbc03dcff8fd3933e
Instruction ID: dcdd4ac753e3b17e91b48083b1ed5a81c6e0117b65d799499727b77f80752211
Opcode Fuzzy Hash: 5d98dab16672489129bf6f5149003e248d0b49a997adcb1bbc03dcff8fd3933e
Instruction Fuzzy Hash: 5901E4B04107009FC360EF29C445757BBE8EB08714F508A1DE8EECB680D770A5948B82

Function 00261440 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 548ba524eaf2bebe6137a75d469d6f37e4e3827a686696653170d8c0b946aeeb
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 4FD0A731608322469F748E19A410977F7F0EAC7B51F4D955EF586E3148D630EC91C2A9

Function 00231ACD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2556dd79a99c833e1e9419e56561f321b591c91c90f092061d51768a78a5b9f6
Instruction ID: fd72078274e65e411f2d3fea62ce518b88284c827e76392443a88c9ad7a329a2
Opcode Fuzzy Hash: 2556dd79a99c833e1e9419e56561f321b591c91c90f092061d51768a78a5b9f6
Instruction Fuzzy Hash: 5DC01235A281008B86849F01BDAD432B2B8A30A309B00A02ADA02E3A21CAA0D4229909

Function 00266094 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 236fbe7613ece4da1661e82a26f490d0361b396d2aef15f928ee7f296b558766
Instruction ID: 673d963ff75e3738911f23db7162abbf66d118354056396be0105a610953a9db
Opcode Fuzzy Hash: 236fbe7613ece4da1661e82a26f490d0361b396d2aef15f928ee7f296b558766
Instruction Fuzzy Hash: E3C09B3467C01087D10CCF04F955475F3769BA772CB24B11DC84A23695C134D552A51C

Function 00231A3C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cddc8a4a16f429407aeb4f6ed6c246ccc34ccb8d57d5cf73e1a781dffe657a6f
Instruction ID: 0ff58a00b855b28ca7cf29282f488cf913d978d0aac5b6f563bc57da0c93148e
Opcode Fuzzy Hash: cddc8a4a16f429407aeb4f6ed6c246ccc34ccb8d57d5cf73e1a781dffe657a6f
Instruction Fuzzy Hash: B9C04C25A691408A86848E86B995431A2A89306209B10703AD702E7661C9A0D4158509

Function 00265FD6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096920661.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2096899924.0000000000220000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000280000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.00000000004F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000529000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2096958000.0000000000538000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097220123.0000000000539000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097326960.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097342904.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5a2adeedb58edce48f5243fd95fc15cee169cdee190399beb8ac7ded4418c2d
Instruction ID: d6a3619a498740daaf9f8d67a6a58cdc937b2689f2a24418ac7fca9d808f3b0d
Opcode Fuzzy Hash: a5a2adeedb58edce48f5243fd95fc15cee169cdee190399beb8ac7ded4418c2d
Instruction Fuzzy Hash: 49C09224B680008BE24CCF18ED55935F2BA9BABA2CB14B02DC84AA3256D134D552960C

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
file.exe

Function 0022FCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Function 0022D110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Function 00265700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Function 00265BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 0026695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Function 0023049B Relevance: .3, Instructions: 264
COMMON

Function 004EFF79 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 107
memoryCOMMON

Function 00263220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Function 00263202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON