Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1531613
MD5:	d28a43b3dbce6278477cc5696847850a
SHA1:	9e50e7ced4ac3ceecca11afaa981e036cd4b84cf
SHA256:	88131cc60d069d251c658a32f17720e443fe37de43eb4b4fbae6500d6e388b5f
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 2096 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D28A43B3DBCE6278477CC5696847850A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["eaglepawnoy.store", "clearancek.site", "dissapoiznw.store", "studennotediw.store", "bathdoomgaz.store", "mobbipenju.store", "licendfilteo.site", "spirittunek.store"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T13:45:06.439382+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49711	172.67.206.204	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T13:45:06.439382+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49711	172.67.206.204	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T13:45:04.191406+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.6	56538	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T13:45:03.908839+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.6	62364	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T13:45:04.053227+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.6	65535	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T13:45:04.041817+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.6	53159	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T13:45:04.227670+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.6	56078	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T13:45:03.926470+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.6	60471	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T13:45:04.216143+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.6	54497	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T13:45:04.167138+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.6	58534	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T13:45:05.369310+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.6	49710	23.192.247.89	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com:443/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware

Found malware configuration

Source: file.exe.2096.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["eaglepawnoy.store", "clearancek.site", "dissapoiznw.store", "studennotediw.store", "bathdoomgaz.store", "mobbipenju.store", "licendfilteo.site", "spirittunek.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 53%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.store
Source: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.store
Source: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.store
Source: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.store
Source: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.store
Source: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.store
Source: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:49711 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00BD50FA
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B9D110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B9D110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_00BD63B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00BD99D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_00BD695B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_00B9FCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_00BA0EEC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00BD6094
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then dec ebx	0_2_00BCF030
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00BA6F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	0_2_00B91000
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00BD4040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00BBD1E1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00BA42FC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00BB2260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_00BB2260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00BC23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00BC23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00BC23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00BC23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00BC23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	0_2_00BC23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebp, eax	0_2_00B9A300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_00BD64B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_00BAB410
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00BBE40C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00BBC470
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00BAD457
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_00BD1440
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	0_2_00B98590
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00BA6536
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	0_2_00BD7520
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00BB9510
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00BBE66A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00BCB650
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00BBD7AF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_00BD67EF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_00BD7710
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00BD5700
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00BB28E9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_00B949A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_00BD3920
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_00BAD961
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00BA1ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00BA1A3C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00B95A50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00BD4A40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00BC0B80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00BA1BEE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00BA3BE2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	0_2_00BADB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	0_2_00BADB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00BD9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00BBAC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], ax	0_2_00BBAC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00BD9CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_00BD9CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_00BBCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00BBCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_00BBCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	0_2_00BCFC20
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_00BB7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_00BBEC48
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00BD8D8A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00BBDD29
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	0_2_00BBFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	0_2_00BA6EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	0_2_00B9BEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_00B96EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00BA1E93
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, ecx	0_2_00BA4E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00BB5E70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00BB7E60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	0_2_00BBAE57
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00BA6F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], 0000h	0_2_00BAFFDF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00B98FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00BD5FD6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00BD7FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00BD7FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00BCFF70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00BB9F62

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.6:60471 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.6:54497 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.6:65535 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.6:62364 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.6:56078 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.6:53159 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.6:58534 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.6:56538 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:49710 -> 23.192.247.89:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49711 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49711 -> 172.67.206.204:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: eaglepawnoy.store
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: dissapoiznw.store
Source: Malware configuration extractor	URLs: studennotediw.store
Source: Malware configuration extractor	URLs: bathdoomgaz.store
Source: Malware configuration extractor	URLs: mobbipenju.store
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: spirittunek.store

Source: Joe Sandbox View	IP Address: 23.192.247.89 23.192.247.89
Source: Joe Sandbox View	IP Address: 172.67.206.204 172.67.206.204

Source: Joe Sandbox View	ASN Name: AKAMAI-ASUS AKAMAI-ASUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ww.youtube.com https://www.google.com https://sketchfab.com https://playT equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, 00000000.00000002.2148763674.000000000168A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000002.2148763674.000000000168A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000002.2148763674.000000000168A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic
Source: file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: file.exe, 00000000.00000002.2148574776.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bathdoomgaz.store:443/apiT
Source: file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akam
Source: file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: file.exe, 00000000.00000002.2148574776.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/apii
Source: file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=2Ih2WOq7ErXY&a
Source: file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: file.exe, 00000000.00000002.2148763674.000000000168A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=Gu9gs5hf
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=M7aU
Source: file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=IZH_ONwLX4kw&l=e
Source: file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampo
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowe
Source: file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: file.exe, 00000000.00000002.2148574776.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site:443/api
Source: file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiY
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apib
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apif
Source: file.exe, 00000000.00000002.2148574776.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/i
Source: file.exe, 00000000.00000002.2148574776.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/api
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: file.exe, 00000000.00000002.2148574776.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store:443/api
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.f
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000002.2148763674.000000000168A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: file.exe, 00000000.00000002.2148763674.000000000168A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000000.00000002.2148574776.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persis
Source: file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000002.2148763674.000000000168A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.stx
Source: file.exe, 00000000.00000002.2148574776.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://studennotediw.store:443/api
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443

Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:49711 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA0228	0_2_00BA0228
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BDA0D0	0_2_00BDA0D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA2030	0_2_00BA2030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B91000	0_2_00B91000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD4040	0_2_00BD4040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B9E1A0	0_2_00B9E1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D621F2	0_2_00D621F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B971F0	0_2_00B971F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B95160	0_2_00B95160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D372DB	0_2_00D372DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DCF2C9	0_2_00DCF2C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D5B2E9	0_2_00D5B2E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D6029E	0_2_00D6029E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B912F7	0_2_00B912F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A298	0_2_00C9A298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D51280	0_2_00D51280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC82D0	0_2_00BC82D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC12D0	0_2_00BC12D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3E201	0_2_00C3E201
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B9B3A0	0_2_00B9B3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B913A3	0_2_00B913A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC23E0	0_2_00BC23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D56366	0_2_00D56366
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B9A300	0_2_00B9A300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA049B	0_2_00BA049B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA4487	0_2_00BA4487
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC64F0	0_2_00BC64F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D644B4	0_2_00D644B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D4246F	0_2_00D4246F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BBC470	0_2_00BBC470
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B935B0	0_2_00B935B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B98590	0_2_00B98590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BAC5F0	0_2_00BAC5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D4E535	0_2_00D4E535
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD86F0	0_2_00BD86F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DCF688	0_2_00DCF688
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCF620	0_2_00BCF620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD8652	0_2_00BD8652
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B9164F	0_2_00B9164F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCE8A0	0_2_00BCE8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CA38EA	0_2_00CA38EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCB8C0	0_2_00BCB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D5E81F	0_2_00D5E81F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC1860	0_2_00BC1860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B9A850	0_2_00B9A850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD89A0	0_2_00BD89A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB098B	0_2_00BB098B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D4C927	0_2_00D4C927
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D5992A	0_2_00D5992A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD7AB0	0_2_00BD7AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD8A80	0_2_00BD8A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD4A40	0_2_00BD4A40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B97BF0	0_2_00B97BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BADB6F	0_2_00BADB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD6CBF	0_2_00BD6CBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BBCCD0	0_2_00BBCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD8C02	0_2_00BD8C02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BBDD29	0_2_00BBDD29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BBFD10	0_2_00BBFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB8D62	0_2_00BB8D62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA6EBF	0_2_00BA6EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B9BEB0	0_2_00B9BEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA4E2A	0_2_00BA4E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D5CE41	0_2_00D5CE41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD8E70	0_2_00BD8E70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D52E0D	0_2_00D52E0D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BBAE57	0_2_00BBAE57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B98FD0	0_2_00B98FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD7FC0	0_2_00BD7FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B9AF10	0_2_00B9AF10

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00BAD300 appears 152 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00B9CAA0 appears 48 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9994714315181518
Source: file.exe	Static PE information: Section: ulxmnlbd ZLIB complexity 0.9945931639443436

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@10/2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BC8220 CoCreateInstance,

0_2_00BC8220

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

Virustotal: Detection: 53%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static file information: File size 1863168 > 1048576

Source: file.exe

Static PE information: Raw size of ulxmnlbd is bigger than: 0x100000 < 0x19d400

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.b90000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ulxmnlbd:EW;llihilhx:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ulxmnlbd:EW;llihilhx:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1d2b2f should be: 0x1c7ca7

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ulxmnlbd
Source: file.exe	Static PE information: section name: llihilhx
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1A0C3 push 17287D85h; mov dword ptr [esp], edi	0_2_00D1A117
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1A0C3 push ecx; mov dword ptr [esp], edi	0_2_00D1A18A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E400C2 push 131A4790h; mov dword ptr [esp], edx	0_2_00E400EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E400C2 push 3AC60D22h; mov dword ptr [esp], edx	0_2_00E40140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E820D1 push edi; mov dword ptr [esp], ebx	0_2_00E820DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E45060 push 57CFA0B7h; mov dword ptr [esp], ecx	0_2_00E45074
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E45060 push ebx; mov dword ptr [esp], edx	0_2_00E4514C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E45060 push edx; mov dword ptr [esp], ebp	0_2_00E451A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE7043 push 6E21B3CEh; mov dword ptr [esp], edi	0_2_00DE709A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DD7079 push 00F0ED1Ch; mov dword ptr [esp], ebp	0_2_00DD7091
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E31059 push ebx; mov dword ptr [esp], ebp	0_2_00E3107D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF6064 push ebp; mov dword ptr [esp], ebx	0_2_00DF60E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE4011 push esi; mov dword ptr [esp], edx	0_2_00DE4015
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D621F2 push ecx; mov dword ptr [esp], 0A7774A7h	0_2_00D62224
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D621F2 push edi; mov dword ptr [esp], 1AB94CBDh	0_2_00D62232
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D621F2 push esi; mov dword ptr [esp], 55BFC2A1h	0_2_00D62389
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D621F2 push edi; mov dword ptr [esp], edx	0_2_00D623E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D621F2 push ecx; mov dword ptr [esp], edx	0_2_00D623FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D621F2 push ebp; mov dword ptr [esp], ebx	0_2_00D62416
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D621F2 push ebp; mov dword ptr [esp], 41BDA180h	0_2_00D6249F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D621F2 push 73209117h; mov dword ptr [esp], esi	0_2_00D62543
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D621F2 push 6A1879D2h; mov dword ptr [esp], ecx	0_2_00D62553
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D621F2 push edx; mov dword ptr [esp], 47E721BEh	0_2_00D62557
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D621F2 push 53593201h; mov dword ptr [esp], eax	0_2_00D6257B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D621F2 push 79690466h; mov dword ptr [esp], edx	0_2_00D625A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D621F2 push 15585F18h; mov dword ptr [esp], esi	0_2_00D62602
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D621F2 push edx; mov dword ptr [esp], eax	0_2_00D6261A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D621F2 push edi; mov dword ptr [esp], eax	0_2_00D62648
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D621F2 push edi; mov dword ptr [esp], ebx	0_2_00D626D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D621F2 push ecx; mov dword ptr [esp], esi	0_2_00D626F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D621F2 push esi; mov dword ptr [esp], 277B896Bh	0_2_00D62751

Source: file.exe	Static PE information: section name: entropy: 7.981198365212424
Source: file.exe	Static PE information: section name: ulxmnlbd entropy: 7.9532776057509755

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF40A4 second address: BF38EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov dword ptr [esp], eax 0x00000009 jns 00007F9F24D1BA77h 0x0000000f push dword ptr [ebp+122D0E51h] 0x00000015 jmp 00007F9F24D1BA7Fh 0x0000001a cmc 0x0000001b call dword ptr [ebp+122D2815h] 0x00000021 pushad 0x00000022 jc 00007F9F24D1BA89h 0x00000028 xor eax, eax 0x0000002a clc 0x0000002b mov edx, dword ptr [esp+28h] 0x0000002f jmp 00007F9F24D1BA84h 0x00000034 add dword ptr [ebp+122D1943h], ebx 0x0000003a mov dword ptr [ebp+122D34CEh], eax 0x00000040 jmp 00007F9F24D1BA80h 0x00000045 mov esi, 0000003Ch 0x0000004a jl 00007F9F24D1BA8Fh 0x00000050 pushad 0x00000051 jmp 00007F9F24D1BA81h 0x00000056 xor dword ptr [ebp+122D1943h], ecx 0x0000005c popad 0x0000005d add esi, dword ptr [esp+24h] 0x00000061 jmp 00007F9F24D1BA88h 0x00000066 lodsw 0x00000068 add dword ptr [ebp+122D1943h], ecx 0x0000006e jng 00007F9F24D1BA84h 0x00000074 pushad 0x00000075 mov eax, dword ptr [ebp+122D34FAh] 0x0000007b jng 00007F9F24D1BA76h 0x00000081 popad 0x00000082 add eax, dword ptr [esp+24h] 0x00000086 jmp 00007F9F24D1BA7Bh 0x0000008b mov ebx, dword ptr [esp+24h] 0x0000008f jno 00007F9F24D1BA82h 0x00000095 push eax 0x00000096 push edx 0x00000097 pushad 0x00000098 push eax 0x00000099 push edx 0x0000009a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6870A second address: D68732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F2573ED25h 0x00000009 pop ecx 0x0000000a ja 00007F9F2573ED1Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D689E8 second address: D689EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68B87 second address: D68B97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007F9F2573ED16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68B97 second address: D68B9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BA1F second address: D6BA25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BA25 second address: D6BA5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b pushad 0x0000000c jg 00007F9F24D1BA76h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 jc 00007F9F24D1BA78h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F9F24D1BA85h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BAF2 second address: D6BAF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BAF6 second address: D6BB7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 jmp 00007F9F24D1BA87h 0x0000000d push 00000000h 0x0000000f adc edi, 0AFC6941h 0x00000015 push 13FBD682h 0x0000001a pushad 0x0000001b jnp 00007F9F24D1BA83h 0x00000021 jmp 00007F9F24D1BA7Dh 0x00000026 push ecx 0x00000027 push esi 0x00000028 pop esi 0x00000029 pop ecx 0x0000002a popad 0x0000002b xor dword ptr [esp], 13FBD602h 0x00000032 mov dword ptr [ebp+122D28F2h], esi 0x00000038 mov dword ptr [ebp+122D3062h], ebx 0x0000003e push 00000003h 0x00000040 jnp 00007F9F24D1BA82h 0x00000046 push 00000000h 0x00000048 mov dword ptr [ebp+122D1E9Ch], ecx 0x0000004e push 00000003h 0x00000050 or di, 0DA5h 0x00000055 push 6448B579h 0x0000005a je 00007F9F24D1BA80h 0x00000060 pushad 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BB7F second address: D6BBAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 add dword ptr [esp], 5BB74A87h 0x0000000e mov dword ptr [ebp+122D2841h], ecx 0x00000014 lea ebx, dword ptr [ebp+1244B944h] 0x0000001a and esi, dword ptr [ebp+122D1BBDh] 0x00000020 xchg eax, ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 push ebx 0x00000024 jbe 00007F9F2573ED16h 0x0000002a pop ebx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BC16 second address: D6BC1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BE34 second address: D6BE38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BF27 second address: D6BF2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BF2B second address: D6BF31 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BF31 second address: D6BF3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F9F24D1BA76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BF3B second address: D6BF3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89618 second address: D8961C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89737 second address: D8974B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9F2573ED1Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8989D second address: D898A7 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9F24D1BA7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D898A7 second address: D898D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F2573ED1Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9F2573ED28h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D898D2 second address: D898F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F24D1BA87h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89AA0 second address: D89AA8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89AA8 second address: D89AB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F9F24D1BA76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89AB2 second address: D89AB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89DB3 second address: D89DCF instructions: 0x00000000 rdtsc 0x00000002 je 00007F9F24D1BA76h 0x00000008 jmp 00007F9F24D1BA7Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89DCF second address: D89DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89DD3 second address: D89DE0 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9F24D1BA76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89DE0 second address: D89DF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F9F2573ED16h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F9F2573ED18h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A04A second address: D8A053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A1ED second address: D8A201 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F9F2573ED1Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A201 second address: D8A23B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9F24D1BA87h 0x00000008 jnp 00007F9F24D1BA76h 0x0000000e jmp 00007F9F24D1BA88h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A363 second address: D8A39C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F9F2573ED16h 0x0000000a popad 0x0000000b push edx 0x0000000c jmp 00007F9F2573ED22h 0x00000011 pop edx 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 pop edx 0x00000016 pushad 0x00000017 jmp 00007F9F2573ED23h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A4C8 second address: D8A4E0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jbe 00007F9F24D1BA76h 0x0000000f pop eax 0x00000010 jl 00007F9F24D1BA82h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A4E0 second address: D8A4E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A4E6 second address: D8A4F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnc 00007F9F24D1BA76h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A4F2 second address: D8A532 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F9F2573ED24h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d jnp 00007F9F2573ED2Bh 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F9F2573ED23h 0x0000001a push eax 0x0000001b jnc 00007F9F2573ED16h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A7E7 second address: D8A7FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b popad 0x0000000c pushad 0x0000000d jo 00007F9F24D1BA7Eh 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A7FE second address: D8A805 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A805 second address: D8A80B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A96A second address: D8A972 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8B055 second address: D8B059 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8B059 second address: D8B05F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8B05F second address: D8B069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8B069 second address: D8B06F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8B06F second address: D8B073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8B073 second address: D8B077 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8B1EB second address: D8B1F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F9F24D1BA76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8B327 second address: D8B32D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8B467 second address: D8B46D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8B729 second address: D8B733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F9F2573ED16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8B733 second address: D8B743 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007F9F24D1BA78h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8B743 second address: D8B749 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F76F second address: D8F784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 js 00007F9F24D1BA84h 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007F9F24D1BA76h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8FBFD second address: D8FC03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8FC03 second address: D8FC08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8FF60 second address: D8FF65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D90F89 second address: D90F8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D90F8F second address: D90F9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F9F2573ED16h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D90F9A second address: D90FA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59471 second address: D59486 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9F2573ED16h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jnp 00007F9F2573ED16h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59486 second address: D5948C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99335 second address: D99349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F2573ED20h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99349 second address: D9934E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99AF1 second address: D99AF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99BEE second address: D99C02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d jbe 00007F9F24D1BA76h 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9A129 second address: D9A12D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9AA2D second address: D9AA33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9B2F8 second address: D9B2FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9D81C second address: D9D896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov dword ptr [esp], eax 0x00000008 pushad 0x00000009 mov dword ptr [ebp+122D2900h], esi 0x0000000f and ebx, 284FCC10h 0x00000015 popad 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007F9F24D1BA78h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 00000019h 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebx 0x00000037 call 00007F9F24D1BA78h 0x0000003c pop ebx 0x0000003d mov dword ptr [esp+04h], ebx 0x00000041 add dword ptr [esp+04h], 00000017h 0x00000049 inc ebx 0x0000004a push ebx 0x0000004b ret 0x0000004c pop ebx 0x0000004d ret 0x0000004e sub dword ptr [ebp+122D20C7h], eax 0x00000054 xchg eax, ebx 0x00000055 jne 00007F9F24D1BA7Eh 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f je 00007F9F24D1BA76h 0x00000065 pop eax 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9D896 second address: D9D89B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9E2CE second address: D9E2D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F4DD second address: D9F4E7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9F2573ED16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA021F second address: DA0233 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9F24D1BA7Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D55E41 second address: D55E46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA78A5 second address: DA78AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA879F second address: DA87B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F2573ED25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7A0B second address: DA7A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA87B8 second address: DA87BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7A0F second address: DA7A19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7A19 second address: DA7A1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA9854 second address: DA9858 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA8990 second address: DA8A30 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9F2573ED1Ch 0x00000008 jng 00007F9F2573ED16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 mov bx, di 0x00000014 push dword ptr fs:[00000000h] 0x0000001b push 00000000h 0x0000001d push esi 0x0000001e call 00007F9F2573ED18h 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], esi 0x00000028 add dword ptr [esp+04h], 0000001Dh 0x00000030 inc esi 0x00000031 push esi 0x00000032 ret 0x00000033 pop esi 0x00000034 ret 0x00000035 mov bl, ah 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e push 00000000h 0x00000040 push ecx 0x00000041 call 00007F9F2573ED18h 0x00000046 pop ecx 0x00000047 mov dword ptr [esp+04h], ecx 0x0000004b add dword ptr [esp+04h], 00000018h 0x00000053 inc ecx 0x00000054 push ecx 0x00000055 ret 0x00000056 pop ecx 0x00000057 ret 0x00000058 mov dword ptr [ebp+122D20C7h], ebx 0x0000005e mov eax, dword ptr [ebp+122D0039h] 0x00000064 pushad 0x00000065 mov di, si 0x00000068 mov ebx, dword ptr [ebp+122D35EAh] 0x0000006e popad 0x0000006f push FFFFFFFFh 0x00000071 jmp 00007F9F2573ED28h 0x00000076 push eax 0x00000077 pushad 0x00000078 push eax 0x00000079 push edx 0x0000007a pushad 0x0000007b popad 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA9A2F second address: DA9A34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA9A34 second address: DA9A39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABA26 second address: DABA59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 ja 00007F9F24D1BA76h 0x0000000d jmp 00007F9F24D1BA89h 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 js 00007F9F24D1BA76h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA9A39 second address: DA9A3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABA59 second address: DABA5F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DADB1F second address: DADB58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jp 00007F9F2573ED22h 0x0000000d pop esi 0x0000000e jnp 00007F9F2573ED47h 0x00000014 push eax 0x00000015 push edx 0x00000016 jne 00007F9F2573ED16h 0x0000001c jmp 00007F9F2573ED21h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABC20 second address: DABC2A instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9F24D1BA76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DADB58 second address: DADB5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAE132 second address: DAE140 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9F24D1BA76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAE140 second address: DAE144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAE144 second address: DAE1C1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9F24D1BA76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e cmc 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007F9F24D1BA78h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b mov bh, 51h 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebp 0x00000032 call 00007F9F24D1BA78h 0x00000037 pop ebp 0x00000038 mov dword ptr [esp+04h], ebp 0x0000003c add dword ptr [esp+04h], 0000001Bh 0x00000044 inc ebp 0x00000045 push ebp 0x00000046 ret 0x00000047 pop ebp 0x00000048 ret 0x00000049 xchg eax, esi 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d jng 00007F9F24D1BA76h 0x00000053 jmp 00007F9F24D1BA85h 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAE3C4 second address: DAE3C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB40C6 second address: DB40CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB40CA second address: DB40D0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB40D0 second address: DB414B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9F24D1BA8Fh 0x00000008 jmp 00007F9F24D1BA89h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007F9F24D1BA85h 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push esi 0x00000019 call 00007F9F24D1BA78h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], esi 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc esi 0x0000002c push esi 0x0000002d ret 0x0000002e pop esi 0x0000002f ret 0x00000030 js 00007F9F24D1BA7Ch 0x00000036 and edi, 5BDAA43Bh 0x0000003c push 00000000h 0x0000003e mov edi, dword ptr [ebp+122D3642h] 0x00000044 push 00000000h 0x00000046 cmc 0x00000047 xchg eax, esi 0x00000048 push ebx 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB414B second address: DB4169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F2573ED22h 0x00000009 popad 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB014E second address: DB0153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB328D second address: DB330D instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9F2573ED16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F9F2573ED24h 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 mov edi, dword ptr [ebp+122D345Eh] 0x00000019 push dword ptr fs:[00000000h] 0x00000020 adc ebx, 6AE070F1h 0x00000026 mov dword ptr fs:[00000000h], esp 0x0000002d mov edi, dword ptr [ebp+122D355Ah] 0x00000033 mov eax, dword ptr [ebp+122D1659h] 0x00000039 mov dword ptr [ebp+122D197Dh], edi 0x0000003f mov dword ptr [ebp+122D1B9Ch], ecx 0x00000045 push FFFFFFFFh 0x00000047 push 00000000h 0x00000049 push ecx 0x0000004a call 00007F9F2573ED18h 0x0000004f pop ecx 0x00000050 mov dword ptr [esp+04h], ecx 0x00000054 add dword ptr [esp+04h], 00000017h 0x0000005c inc ecx 0x0000005d push ecx 0x0000005e ret 0x0000005f pop ecx 0x00000060 ret 0x00000061 sbb di, 4923h 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0153 second address: DB0159 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB330D second address: DB3314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0159 second address: DB015D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB3314 second address: DB331A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB015D second address: DB0192 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F24D1BA85h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F9F24D1BA85h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0192 second address: DB0198 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0198 second address: DB019E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB019E second address: DB01A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB53C9 second address: DB53D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F9F24D1BA76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB53D3 second address: DB53D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB71AA second address: DB720E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F24D1BA7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F9F24D1BA78h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov dword ptr [ebp+122D2532h], ecx 0x0000002c push 00000000h 0x0000002e mov edi, 6D93C439h 0x00000033 push 00000000h 0x00000035 je 00007F9F24D1BA86h 0x0000003b jmp 00007F9F24D1BA80h 0x00000040 xchg eax, esi 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 jns 00007F9F24D1BA76h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB720E second address: DB7218 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB7218 second address: DB721C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEB59 second address: DBEB5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D71E second address: D4D728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F9F24D1BA76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D728 second address: D4D740 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9F2573ED16h 0x00000008 jmp 00007F9F2573ED1Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D740 second address: D4D754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F24D1BA7Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D754 second address: D4D772 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F2573ED28h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D772 second address: D4D776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D776 second address: D4D79D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F9F2573ED26h 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D79D second address: D4D7C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F9F24D1BA76h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jns 00007F9F24D1BA76h 0x00000014 jmp 00007F9F24D1BA83h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D7C5 second address: D4D7E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9F2573ED29h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE324 second address: DBE328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE4A9 second address: DBE4AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE4AF second address: DBE4B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE4B3 second address: DBE4B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE62C second address: DBE643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 jmp 00007F9F24D1BA80h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE643 second address: DBE659 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F2573ED20h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC37FF second address: DC3805 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8457 second address: DC8460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8460 second address: DC8468 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8468 second address: DC846C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC89FE second address: DC8A04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8A04 second address: DC8A23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 pushad 0x00000007 jng 00007F9F2573ED1Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007F9F2573ED16h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8A23 second address: DC8A27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8A27 second address: DC8A3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jg 00007F9F2573ED16h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8E3F second address: DC8E4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jo 00007F9F24D1BA76h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8E4E second address: DC8E82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push edi 0x00000008 jmp 00007F9F2573ED1Eh 0x0000000d jmp 00007F9F2573ED28h 0x00000012 pop edi 0x00000013 popad 0x00000014 push edi 0x00000015 push esi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8FF8 second address: DC8FFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8FFE second address: DC901A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F9F2573ED21h 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC9154 second address: DC9158 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC951D second address: DC9521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC9521 second address: DC9532 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007F9F24D1BA76h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCDAD8 second address: DCDADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCE079 second address: DCE096 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9F24D1BA88h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCE223 second address: DCE227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCE227 second address: DCE23A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9F24D1BA76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b je 00007F9F24D1BA76h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCE23A second address: DCE24D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jl 00007F9F2573ED18h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCE24D second address: DCE257 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9F24D1BA76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCE907 second address: DCE90C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7F8D8 second address: D7F8DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCEDA0 second address: DCEDAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jo 00007F9F2573ED16h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCEDAC second address: DCEDB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCEDB0 second address: DCEDC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F9F2573ED16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F9F2573ED16h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCEDC6 second address: DCEDCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD340A second address: DD3423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F9F2573ED16h 0x0000000a jmp 00007F9F2573ED1Eh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA2BAF second address: DA2BB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA2C5C second address: DA2C60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA2C60 second address: DA2C66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA2C66 second address: DA2C6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA2C6C second address: DA2C70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA2C70 second address: BF38EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+12470F26h], ecx 0x00000011 push eax 0x00000012 xor dword ptr [ebp+122D2067h], ebx 0x00000018 pop edi 0x00000019 push dword ptr [ebp+122D0E51h] 0x0000001f mov dword ptr [ebp+122D1F26h], ebx 0x00000025 call dword ptr [ebp+122D2815h] 0x0000002b pushad 0x0000002c jc 00007F9F2573ED29h 0x00000032 jmp 00007F9F2573ED23h 0x00000037 xor eax, eax 0x00000039 clc 0x0000003a mov edx, dword ptr [esp+28h] 0x0000003e jmp 00007F9F2573ED24h 0x00000043 add dword ptr [ebp+122D1943h], ebx 0x00000049 mov dword ptr [ebp+122D34CEh], eax 0x0000004f jmp 00007F9F2573ED20h 0x00000054 mov esi, 0000003Ch 0x00000059 jl 00007F9F2573ED2Fh 0x0000005f pushad 0x00000060 jmp 00007F9F2573ED21h 0x00000065 xor dword ptr [ebp+122D1943h], ecx 0x0000006b popad 0x0000006c add esi, dword ptr [esp+24h] 0x00000070 jmp 00007F9F2573ED28h 0x00000075 lodsw 0x00000077 add dword ptr [ebp+122D1943h], ecx 0x0000007d jng 00007F9F2573ED24h 0x00000083 pushad 0x00000084 mov eax, dword ptr [ebp+122D34FAh] 0x0000008a jng 00007F9F2573ED16h 0x00000090 popad 0x00000091 add eax, dword ptr [esp+24h] 0x00000095 jmp 00007F9F2573ED1Bh 0x0000009a mov ebx, dword ptr [esp+24h] 0x0000009e jno 00007F9F2573ED22h 0x000000a4 push eax 0x000000a5 push edx 0x000000a6 pushad 0x000000a7 push eax 0x000000a8 push edx 0x000000a9 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA2CF1 second address: DA2CF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA2CF6 second address: DA2D23 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9F2573ED2Eh 0x00000008 jmp 00007F9F2573ED28h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 jnc 00007F9F2573ED16h 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA2D23 second address: DA2D5C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9F24D1BA78h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F9F24D1BA84h 0x00000013 mov eax, dword ptr [eax] 0x00000015 pushad 0x00000016 jmp 00007F9F24D1BA7Ah 0x0000001b push eax 0x0000001c push edx 0x0000001d jnp 00007F9F24D1BA76h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA2EBA second address: DA2EED instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9F2573ED16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F9F2573ED1Dh 0x00000012 jnc 00007F9F2573ED18h 0x00000018 popad 0x00000019 xchg eax, esi 0x0000001a and di, F944h 0x0000001f mov di, C129h 0x00000023 push eax 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA3235 second address: DA325F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9F24D1BA7Ch 0x00000008 jnc 00007F9F24D1BA76h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9F24D1BA87h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA38DD second address: DA38FE instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9F2573ED1Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 ja 00007F9F2573ED16h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA38FE second address: DA391F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F9F24D1BA7Ch 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push esi 0x00000016 pop esi 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA391F second address: DA3929 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9F2573ED1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA3A12 second address: DA3A47 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9F24D1BA76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jg 00007F9F24D1BA76h 0x00000011 pop eax 0x00000012 popad 0x00000013 mov dword ptr [esp], eax 0x00000016 pushad 0x00000017 mov dword ptr [ebp+122D20DDh], edx 0x0000001d popad 0x0000001e lea eax, dword ptr [ebp+124824C8h] 0x00000024 mov ecx, dword ptr [ebp+122D2867h] 0x0000002a nop 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jne 00007F9F24D1BA76h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA3A47 second address: DA3A61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F2573ED26h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA3A61 second address: D7F8D8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 js 00007F9F24D1BA80h 0x0000000f pushad 0x00000010 jl 00007F9F24D1BA76h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 nop 0x0000001a jmp 00007F9F24D1BA7Ah 0x0000001f call dword ptr [ebp+122D2F92h] 0x00000025 push ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD39C4 second address: DD39E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9F2573ED1Dh 0x0000000a je 00007F9F2573ED18h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD3B9B second address: DD3BA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD3BA1 second address: DD3BB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jno 00007F9F2573ED16h 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD3BB1 second address: DD3BB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD3BB6 second address: DD3BBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD3BBC second address: DD3BC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD3D19 second address: DD3D1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD3D1D second address: DD3D25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD78F5 second address: DD78FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F9F2573ED16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDB97A second address: DDB97E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDB97E second address: DDB9A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F2573ED23h 0x00000007 jmp 00007F9F2573ED1Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDFDD5 second address: DDFDEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F9F24D1BA76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007F9F24D1BA76h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDFDEA second address: DDFE0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F9F2573ED28h 0x0000000e jmp 00007F9F2573ED22h 0x00000013 pushad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDFE0F second address: DDFE31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F24D1BA88h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE03C3 second address: DE03DB instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9F2573ED16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F9F2573ED1Ch 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE03DB second address: DE040C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F24D1BA81h 0x00000007 push eax 0x00000008 jmp 00007F9F24D1BA86h 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE040C second address: DE0412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE0412 second address: DE0420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F9F24D1BA76h 0x0000000a popad 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE0420 second address: DE042D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F9F2573ED16h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE042D second address: DE043B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F9F24D1BA7Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE3D7D second address: DE3D87 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9F2573ED16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE3D87 second address: DE3D92 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jng 00007F9F24D1BA76h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE6F3F second address: DE6F4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9F2573ED16h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE6AFE second address: DE6B07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE6B07 second address: DE6B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE6B0D second address: DE6B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jo 00007F9F24D1BA76h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE6C9F second address: DE6CB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F9F2573ED16h 0x0000000a popad 0x0000000b jc 00007F9F2573ED1Eh 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB082 second address: DEB0A3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pop edx 0x0000000c jmp 00007F9F24D1BA84h 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB0A3 second address: DEB0B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F9F2573ED16h 0x0000000a jmp 00007F9F2573ED1Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB0B9 second address: DEB0BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB1F7 second address: DEB20A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F9F2573ED22h 0x0000000b jbe 00007F9F2573ED16h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB4DC second address: DEB4E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEE66D second address: DEE6A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F9F2573ED28h 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F9F2573ED22h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEDE54 second address: DEDE68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F9F24D1BA7Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4D11 second address: DF4D38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F9F2573ED16h 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f pushad 0x00000010 jmp 00007F9F2573ED25h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4D38 second address: DF4D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 jmp 00007F9F24D1BA7Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5131 second address: DF513B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF513B second address: DF5163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F24D1BA81h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F9F24D1BA7Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF52E7 second address: DF52ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5E86 second address: DF5E8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFDA19 second address: DFDA36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F2573ED29h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE515 second address: DFE51B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE51B second address: DFE51F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE51F second address: DFE523 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE523 second address: DFE53E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F2573ED21h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE53E second address: DFE544 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE544 second address: DFE55D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F9F2573ED16h 0x00000009 pushad 0x0000000a popad 0x0000000b jc 00007F9F2573ED16h 0x00000011 popad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push edi 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFEA78 second address: DFEA7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFEA7C second address: DFEA91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F9F2573ED1Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFF03D second address: DFF05A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F24D1BA89h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFF05A second address: DFF06C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9F2573ED1Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFF06C second address: DFF072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFF072 second address: DFF078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFF078 second address: DFF081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFF081 second address: DFF085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFF085 second address: DFF08B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFF08B second address: DFF099 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F9F2573ED1Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFF390 second address: DFF3B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F9F24D1BA76h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push ebx 0x0000000e jmp 00007F9F24D1BA89h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E025BB second address: E025C0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0289A second address: E028AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F24D1BA81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02A16 second address: E02A1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02A1A second address: E02A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F9F24D1BA76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007F9F24D1BA7Ah 0x00000012 push eax 0x00000013 pop eax 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 jmp 00007F9F24D1BA7Dh 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02F85 second address: E02FB9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9F2573ED26h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9F2573ED28h 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03114 second address: E0311C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5294A second address: D52950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D52950 second address: D5299A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9F24D1BA76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F9F24D1BA89h 0x0000000f popad 0x00000010 push edx 0x00000011 push ebx 0x00000012 jmp 00007F9F24D1BA7Fh 0x00000017 jmp 00007F9F24D1BA7Eh 0x0000001c pop ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09309 second address: E09311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09311 second address: E09326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F24D1BA80h 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0F4D0 second address: E0F4D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0F4D4 second address: E0F4D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0F93A second address: E0F942 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FD72 second address: E0FD80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F9F24D1BA7Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10B09 second address: E10B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10B0F second address: E10B17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0EB5F second address: E0EB78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F9F2573ED1Bh 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E23497 second address: E2349D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2349D second address: E234AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E234AA second address: E234B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E23019 second address: E2301F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2301F second address: E23067 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9F24D1BA85h 0x0000000b jmp 00007F9F24D1BA87h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9F24D1BA83h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25FEF second address: E25FF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2FB31 second address: E2FB50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9F24D1BA85h 0x00000009 jng 00007F9F24D1BA76h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2FB50 second address: E2FB61 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F9F2573ED29h 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37BD9 second address: E37BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3AAEF second address: E3AAF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3AAF5 second address: E3AB0A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007F9F24D1BA76h 0x0000000d jne 00007F9F24D1BA76h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F99F second address: E3F9B9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9F2573ED16h 0x00000008 js 00007F9F2573ED16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jl 00007F9F2573ED16h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F9B9 second address: E3F9BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F9BF second address: E3F9C9 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9F2573ED1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3FC2E second address: E3FC32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3FC32 second address: E3FC4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9F2573ED22h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3FC4C second address: E3FC50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3FD91 second address: E3FD9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F9F2573ED27h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3FD9D second address: E3FDB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F24D1BA7Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3FDB2 second address: E3FDB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3FF3E second address: E3FF6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F24D1BA7Ah 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jl 00007F9F24D1BA76h 0x00000010 jmp 00007F9F24D1BA7Dh 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3FF6A second address: E3FF70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3FF70 second address: E3FF74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40217 second address: E4021D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4021D second address: E40221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40221 second address: E40231 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F2573ED1Bh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E43793 second address: E43799 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E43799 second address: E4379F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44D26 second address: E44D32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44D32 second address: E44D3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44D3D second address: E44D59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9F24D1BA76h 0x0000000a jns 00007F9F24D1BA76h 0x00000010 jmp 00007F9F24D1BA7Bh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46CC7 second address: E46CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46CCB second address: E46CF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F24D1BA7Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c jmp 00007F9F24D1BA81h 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46CF4 second address: E46D06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F2573ED1Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46D06 second address: E46D12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F9F24D1BA76h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46D12 second address: E46D16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46A40 second address: E46A4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F9F24D1BA76h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5664D second address: E56655 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56655 second address: E56663 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9F24D1BA76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56663 second address: E56667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56667 second address: E5666B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5666B second address: E56690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F2573ED29h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edi 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56690 second address: E566A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9F24D1BA7Ah 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E544A4 second address: E544AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E655A4 second address: E655AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E653F9 second address: E6540C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F2573ED1Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6540C second address: E65410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E65410 second address: E65416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6997C second address: E69999 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnp 00007F9F24D1BA76h 0x00000009 jno 00007F9F24D1BA76h 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 js 00007F9F24D1BA76h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E69999 second address: E6999D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E694EA second address: E694F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007F9F24D1BA76h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E69656 second address: E6965C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6965C second address: E69665 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E69665 second address: E69674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jo 00007F9F2573ED38h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E69674 second address: E69682 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F9F24D1BA76h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E69682 second address: E6968C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9F2573ED16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E815BC second address: E815D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F24D1BA86h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E815D6 second address: E815DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E815DA second address: E815E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E815E0 second address: E815EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F9F2573ED16h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E815EE second address: E815F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E815F2 second address: E815F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E816F4 second address: E816FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E816FA second address: E81700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81700 second address: E8171D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pop edx 0x00000009 popad 0x0000000a jo 00007F9F24D1BA88h 0x00000010 push edi 0x00000011 jmp 00007F9F24D1BA7Ah 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81A19 second address: E81A1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81CD4 second address: E81CDE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9F24D1BA76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81FA5 second address: E81FD7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F2573ED26h 0x00000007 jmp 00007F9F2573ED28h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81FD7 second address: E81FF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9F24D1BA85h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81FF0 second address: E81FF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E820F9 second address: E820FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E820FD second address: E8210D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F9F2573ED1Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8227F second address: E82283 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E82283 second address: E822A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F9F2573ED1Ch 0x0000000c jnc 00007F9F2573ED18h 0x00000012 push eax 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83C71 second address: E83C89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F9F24D1BA7Ch 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83B2A second address: E83B30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83B30 second address: E83B3A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9F24D1BA76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85374 second address: E85378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E87E0E second address: E87E12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E87E12 second address: E87E16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E87EFB second address: E87F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E880D8 second address: E88158 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F9F2573ED18h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D28D7h], esi 0x0000002b push 00000004h 0x0000002d push 00000000h 0x0000002f push esi 0x00000030 call 00007F9F2573ED18h 0x00000035 pop esi 0x00000036 mov dword ptr [esp+04h], esi 0x0000003a add dword ptr [esp+04h], 0000001Dh 0x00000042 inc esi 0x00000043 push esi 0x00000044 ret 0x00000045 pop esi 0x00000046 ret 0x00000047 mov dh, cl 0x00000049 sbb edx, 47B52AE4h 0x0000004f call 00007F9F2573ED19h 0x00000054 jmp 00007F9F2573ED1Ah 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d jo 00007F9F2573ED16h 0x00000063 pushad 0x00000064 popad 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88158 second address: E88162 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9F24D1BA7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88162 second address: E8818E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b jmp 00007F9F2573ED28h 0x00000010 pushad 0x00000011 jno 00007F9F2573ED16h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8818E second address: E881B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007F9F24D1BA8Dh 0x00000010 jmp 00007F9F24D1BA87h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E881B5 second address: E881BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E881BB second address: E881BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88461 second address: E88467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88467 second address: E88493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov edx, 11EE6E5Eh 0x0000000c push dword ptr [ebp+122D1E16h] 0x00000012 mov dword ptr [ebp+122D257Ch], edx 0x00000018 mov edx, 0B88F5A0h 0x0000001d push C33E3BAFh 0x00000022 ja 00007F9F24D1BA84h 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88493 second address: E88497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8AF16 second address: E8AF3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007F9F24D1BA85h 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8AF3A second address: E8AF3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5210DB6 second address: 5210DDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [eax+00000FDCh] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F9F24D1BA88h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5210DDF second address: 5210DE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5210DE5 second address: 5210DE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5210DE9 second address: 5210E7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F2573ED1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test ecx, ecx 0x0000000d jmp 00007F9F2573ED1Eh 0x00000012 jns 00007F9F2573ED3Dh 0x00000018 jmp 00007F9F2573ED20h 0x0000001d add eax, ecx 0x0000001f pushad 0x00000020 call 00007F9F2573ED1Eh 0x00000025 mov ebx, ecx 0x00000027 pop ecx 0x00000028 mov eax, edi 0x0000002a popad 0x0000002b mov eax, dword ptr [eax+00000860h] 0x00000031 pushad 0x00000032 call 00007F9F2573ED1Fh 0x00000037 mov ecx, 10B3E3AFh 0x0000003c pop ecx 0x0000003d jmp 00007F9F2573ED25h 0x00000042 popad 0x00000043 test eax, eax 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F9F2573ED1Dh 0x0000004c rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BF3854 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BF3942 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DA2835 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E19B17 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 5552

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2148574776.00000000015BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW1
Source: file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BD5BB0 LdrInitializeThunk,

0_2_00BD5BB0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: licendfilteo.site
Source: file.exe	String found in binary or memory: clearancek.site
Source: file.exe	String found in binary or memory: bathdoomgaz.stor
Source: file.exe	String found in binary or memory: spirittunek.stor
Source: file.exe	String found in binary or memory: dissapoiznw.stor
Source: file.exe	String found in binary or memory: studennotediw.stor
Source: file.exe	String found in binary or memory: mobbipenju.stor
Source: file.exe	String found in binary or memory: eaglepawnoy.stor

Source: file.exe, file.exe, 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	631 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	54%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.ZPACK.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://player.vimeo.com	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://steamcommunity.com:443/profiles/76561199724331900	100%	URL Reputation	malware
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	23.192.247.89	true	true	unknown
sergei-esenin.com	172.67.206.204	true	true	unknown
eaglepawnoy.store	unknown	unknown	true	unknown
bathdoomgaz.store	unknown	unknown	true	unknown
spirittunek.store	unknown	unknown	true	unknown
licendfilteo.site	unknown	unknown	true	unknown
studennotediw.store	unknown	unknown	true	unknown
mobbipenju.store	unknown	unknown	true	unknown
clearancek.site	unknown	unknown	true	unknown
dissapoiznw.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
studennotediw.store	true		unknown
dissapoiznw.store	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
eaglepawnoy.store	true		unknown
bathdoomgaz.store	true		unknown
clearancek.site	true		unknown
spirittunek.store	true		unknown
licendfilteo.site	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/;Persis	file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/	file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.valvesoftware.com/legal.htm	file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com	file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://s.ytimg.com;	file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steam.tv/	file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://licendfilteo.site:443/api	file.exe, 00000000.00000002.2148574776.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000002.2148763674.000000000168A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com:443/profiles/76561199724331900	file.exe, 00000000.00000002.2148574776.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=M7aU	file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/points/shop/	file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.stx	file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sketchfab.com	file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bathdoomgaz.store:443/apiT	file.exe, 00000000.00000002.2148574776.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	file.exe, 00000000.00000002.2148763674.000000000168A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://www.youtube.com/	file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.akam	file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com:443/api	file.exe, 00000000.00000002.2148574776.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=2Ih2WOq7ErXY&a	file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/i	file.exe, 00000000.00000002.2148574776.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.0000000001662000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://avatars.akamai.steamstatic	file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;	file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/my/wishlist/	file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/apib	file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://help.steampowered.com/en/	file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/market/	file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/	file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/apif	file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowe	file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000002.2148763674.000000000168A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	file.exe, 00000000.00000002.2148763674.000000000168A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/apiY	file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net/recaptcha/;	file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/discussions/	file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://medal.tv	file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	file.exe, 00000000.00000002.2148763674.000000000168A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/steam_refunds/	file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampo	file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steambroadcast.f	file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/workshop/	file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/legal/	file.exe, 00000000.00000002.2148763674.000000000168A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=Gu9gs5hf	file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=IZH_ONwLX4kw&l=e	file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net	file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://studennotediw.store:443/api	file.exe, 00000000.00000002.2148574776.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	file.exe, 00000000.00000003.2147642933.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2148574776.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://127.0.0.1:27060	file.exe, 00000000.00000003.2137990496.0000000001662000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://clearancek.site:443/apii	file.exe, 00000000.00000002.2148574776.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	file.exe, 00000000.00000003.2137923043.0000000001678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147609286.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spirittunek.store:443/api	file.exe, 00000000.00000002.2148574776.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2147642933.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.192.247.89	steamcommunity.com	United States		16625	AKAMAI-ASUS	true
172.67.206.204	sergei-esenin.com	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1531613
Start date and time:	2024-10-11 13:44:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@10/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, otelrules.azureedge.net
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:45:02	API Interceptor	3x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
23.192.247.89	TtiLyVLw3Q.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	kwVoiAAfGm.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	ASmartCore_[1MB]_[unsign].exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	Setup-Premium.exe	Get hash	malicious	LummaC	Browse
172.67.206.204	file.exe	Get hash	malicious	LummaC	Browse
	kwVoiAAfGm.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	TtiLyVLw3Q.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	kwVoiAAfGm.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	nU3dGuezsg.exe	Get hash	malicious	Amadey, Stealc	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	l0T55kCdTI.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	23.199.218.33
sergei-esenin.com	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	TtiLyVLw3Q.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	kwVoiAAfGm.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	l0T55kCdTI.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://docsend.com/view/yw8rtf7gp9v6uesg	Get hash	malicious	Unknown	Browse	104.18.41.137
	https://linklock.titanhq.com/analyse?url=https%3A%2F%2Fwww.hudl.com%2Fnotifications-tracking%2Ftracker%2FBulkDownloadReady-6151bba290ef2e043c74df7a-6040b153-3f06-4375-9d9d-2976d6f1ac3e-11012597%2Femail%2Flanding%3Fforward%3Dhttps%3A%2F%2Fwww.google.com.sg%2Furl%3Fq%3Damp%2Fs%2Fhosxxrs.com%2F.drogo&data=eJxkkEGL3CAUgH-NcygY9Gl0hKZ0S2qZwy6l0_vyjCYja3RqEjL99yVLoYfeHu87vO99Q2ccBH2WmipgikqtkBrnJQUX8IxaCuHcyXcfTnP3UWnWniWEhmuGDIA1KI1yjVH-fH3--f3y8vrU91_71-fL9Xp5-fZ5fjRTKVMKzVDmT6eli3ksRLIB73FNAWuOeTrYqXZ-rZiJZG6LyYcJ39dbd1vX-0LEEwFLwO773tw2nw5IwOayxjEOuMaSF7pWHN5ingjY9zFUAvbLlt76sudU0P8I6H9TxVvuHIJhYYTApBi09KNGqphkjreCivFIIXRLjTeegtHKq5HjIALlnHFojSZgw4wxEbAJsz_OCjuWumP1RPT_a_8L0SyH4lYTEfYXET3OdwJ2IWBvZXk86vL3u8bXMpU_AQAA___Ij4KF#ask.gcr@zendesk.com	Get hash	malicious	Unknown	Browse	104.16.123.96
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://skarinbroekmanvanvliets.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse	104.19.148.54
	https://smolliehallpulsincoukg.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse	104.19.148.54
	024.xlsx.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	172.67.74.152
	https://acr1-br.com/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Play_VM-Now(Gracehealthmi)CLQD-68d4d7d5ab7d9dd5e551e3b0c7ea5fc5.html	Get hash	malicious	Unknown	Browse	104.16.79.73
	https://mkoirelandie.blob.core.windows.net/madelinelarkin/mkoprojects.html	Get hash	malicious	HTMLPhisher	Browse	172.67.166.38
	TtiLyVLw3Q.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
AKAMAI-ASUS	SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	TtiLyVLw3Q.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	na.elf	Get hash	malicious	Mirai	Browse	23.64.233.20
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	na.elf	Get hash	malicious	Mirai	Browse	23.36.242.170
	kwVoiAAfGm.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	na.elf	Get hash	malicious	Mirai	Browse	184.86.165.80
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Get hash	malicious	LummaC	Browse	23.192.247.89 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89 172.67.206.204
	TtiLyVLw3Q.exe	Get hash	malicious	LummaC	Browse	23.192.247.89 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89 172.67.206.204
	7hmGbJQzp5.xlam	Get hash	malicious	Hidden Macro 4.0	Browse	23.192.247.89 172.67.206.204
	xlwings.xlam	Get hash	malicious	Hidden Macro 4.0	Browse	23.192.247.89 172.67.206.204
	PI-4009832-2024.xlam.xlsx	Get hash	malicious	Unknown	Browse	23.192.247.89 172.67.206.204
	kwVoiAAfGm.exe	Get hash	malicious	LummaC	Browse	23.192.247.89 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89 172.67.206.204

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947531984074342
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'863'168 bytes
MD5:	d28a43b3dbce6278477cc5696847850a
SHA1:	9e50e7ced4ac3ceecca11afaa981e036cd4b84cf
SHA256:	88131cc60d069d251c658a32f17720e443fe37de43eb4b4fbae6500d6e388b5f
SHA512:	d39399b4cb2e983afc9937c0fe65756c036d6ca64f06230562b442d20cab79b320c2696abb1379202bed8aab4c4f8408b1bf1b8107b93eded4802266a1a3efa7
SSDEEP:	49152:VS/kbttBvUw3QGwuT2Spm7F8u6N+bsQ9/bAJ6Pt:3d3QGFSS8B8vwV9/bAJ6P
TLSH:	F185330ECF031DB7C5962CB8E9929CDCD60E995724FE1A13CF671158180FEA6ACA2D49
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f.............................PJ...........@...........................J...../+....@.................................W...k..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8a5000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F9F247DAE7Ah
cmovl ebx, dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F9F247DCE75h
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x25e00	eb5f86f9e627fb29ea9b16ec84bcaff5	False	0.9994714315181518	data	7.981198365212424	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	fe72def8b74193a84232a780098a7ce0	False	0.150390625	data	1.04205214219471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x60000	0x2a6000	0x200	89a85b646df1ba1b2533d2549d1f562d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ulxmnlbd	0x306000	0x19e000	0x19d400	28acb20f692ab051d6deca8c902718d2	False	0.9945931639443436	data	7.9532776057509755	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
llihilhx	0x4a4000	0x1000	0x600	b233e4cd702efe3b10c81ea6c0d7c61e	False	0.5572916666666666	data	4.967256496433295	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4a5000	0x3000	0x2200	ca55a1cd5cfa4257538b13240b1813b3	False	0.06767003676470588	DOS executable (COM)	0.7444233342150992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-11T13:45:03.908839+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.6	62364	1.1.1.1	53	UDP
2024-10-11T13:45:03.926470+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.6	60471	1.1.1.1	53	UDP
2024-10-11T13:45:04.041817+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.6	53159	1.1.1.1	53	UDP
2024-10-11T13:45:04.053227+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.6	65535	1.1.1.1	53	UDP
2024-10-11T13:45:04.167138+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.6	58534	1.1.1.1	53	UDP
2024-10-11T13:45:04.191406+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.6	56538	1.1.1.1	53	UDP
2024-10-11T13:45:04.216143+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.6	54497	1.1.1.1	53	UDP
2024-10-11T13:45:04.227670+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.6	56078	1.1.1.1	53	UDP
2024-10-11T13:45:05.369310+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.6	49710	23.192.247.89	443	TCP
2024-10-11T13:45:06.439382+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49711	172.67.206.204	443	TCP
2024-10-11T13:45:06.439382+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49711	172.67.206.204	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 11, 2024 13:45:04.249640942 CEST	49710	443	192.168.2.6	23.192.247.89
Oct 11, 2024 13:45:04.249737978 CEST	443	49710	23.192.247.89	192.168.2.6
Oct 11, 2024 13:45:04.249851942 CEST	49710	443	192.168.2.6	23.192.247.89
Oct 11, 2024 13:45:04.252989054 CEST	49710	443	192.168.2.6	23.192.247.89
Oct 11, 2024 13:45:04.253026962 CEST	443	49710	23.192.247.89	192.168.2.6
Oct 11, 2024 13:45:04.877291918 CEST	443	49710	23.192.247.89	192.168.2.6
Oct 11, 2024 13:45:04.877376080 CEST	49710	443	192.168.2.6	23.192.247.89
Oct 11, 2024 13:45:04.881038904 CEST	49710	443	192.168.2.6	23.192.247.89
Oct 11, 2024 13:45:04.881062984 CEST	443	49710	23.192.247.89	192.168.2.6
Oct 11, 2024 13:45:04.881294012 CEST	443	49710	23.192.247.89	192.168.2.6
Oct 11, 2024 13:45:04.928015947 CEST	49710	443	192.168.2.6	23.192.247.89
Oct 11, 2024 13:45:04.975400925 CEST	443	49710	23.192.247.89	192.168.2.6
Oct 11, 2024 13:45:05.369332075 CEST	443	49710	23.192.247.89	192.168.2.6
Oct 11, 2024 13:45:05.369353056 CEST	443	49710	23.192.247.89	192.168.2.6
Oct 11, 2024 13:45:05.369380951 CEST	443	49710	23.192.247.89	192.168.2.6
Oct 11, 2024 13:45:05.369400024 CEST	443	49710	23.192.247.89	192.168.2.6
Oct 11, 2024 13:45:05.369421959 CEST	443	49710	23.192.247.89	192.168.2.6
Oct 11, 2024 13:45:05.369436026 CEST	49710	443	192.168.2.6	23.192.247.89
Oct 11, 2024 13:45:05.369487047 CEST	443	49710	23.192.247.89	192.168.2.6
Oct 11, 2024 13:45:05.369518042 CEST	49710	443	192.168.2.6	23.192.247.89
Oct 11, 2024 13:45:05.369539976 CEST	49710	443	192.168.2.6	23.192.247.89
Oct 11, 2024 13:45:05.457576036 CEST	443	49710	23.192.247.89	192.168.2.6
Oct 11, 2024 13:45:05.457617044 CEST	443	49710	23.192.247.89	192.168.2.6
Oct 11, 2024 13:45:05.457717896 CEST	49710	443	192.168.2.6	23.192.247.89
Oct 11, 2024 13:45:05.457758904 CEST	443	49710	23.192.247.89	192.168.2.6
Oct 11, 2024 13:45:05.457813978 CEST	49710	443	192.168.2.6	23.192.247.89
Oct 11, 2024 13:45:05.467876911 CEST	443	49710	23.192.247.89	192.168.2.6
Oct 11, 2024 13:45:05.467905998 CEST	443	49710	23.192.247.89	192.168.2.6
Oct 11, 2024 13:45:05.467942953 CEST	443	49710	23.192.247.89	192.168.2.6
Oct 11, 2024 13:45:05.467955112 CEST	49710	443	192.168.2.6	23.192.247.89
Oct 11, 2024 13:45:05.467998028 CEST	49710	443	192.168.2.6	23.192.247.89
Oct 11, 2024 13:45:05.470638990 CEST	49710	443	192.168.2.6	23.192.247.89
Oct 11, 2024 13:45:05.470675945 CEST	443	49710	23.192.247.89	192.168.2.6
Oct 11, 2024 13:45:05.470700979 CEST	49710	443	192.168.2.6	23.192.247.89
Oct 11, 2024 13:45:05.470715046 CEST	443	49710	23.192.247.89	192.168.2.6
Oct 11, 2024 13:45:05.502362013 CEST	49711	443	192.168.2.6	172.67.206.204
Oct 11, 2024 13:45:05.502382994 CEST	443	49711	172.67.206.204	192.168.2.6
Oct 11, 2024 13:45:05.502476931 CEST	49711	443	192.168.2.6	172.67.206.204
Oct 11, 2024 13:45:05.502820015 CEST	49711	443	192.168.2.6	172.67.206.204
Oct 11, 2024 13:45:05.502830982 CEST	443	49711	172.67.206.204	192.168.2.6
Oct 11, 2024 13:45:05.964458942 CEST	443	49711	172.67.206.204	192.168.2.6
Oct 11, 2024 13:45:05.964649916 CEST	49711	443	192.168.2.6	172.67.206.204
Oct 11, 2024 13:45:05.967284918 CEST	49711	443	192.168.2.6	172.67.206.204
Oct 11, 2024 13:45:05.967298031 CEST	443	49711	172.67.206.204	192.168.2.6
Oct 11, 2024 13:45:05.967513084 CEST	443	49711	172.67.206.204	192.168.2.6
Oct 11, 2024 13:45:05.968717098 CEST	49711	443	192.168.2.6	172.67.206.204
Oct 11, 2024 13:45:05.968733072 CEST	49711	443	192.168.2.6	172.67.206.204
Oct 11, 2024 13:45:05.968775034 CEST	443	49711	172.67.206.204	192.168.2.6
Oct 11, 2024 13:45:06.439380884 CEST	443	49711	172.67.206.204	192.168.2.6
Oct 11, 2024 13:45:06.439476967 CEST	443	49711	172.67.206.204	192.168.2.6
Oct 11, 2024 13:45:06.439547062 CEST	49711	443	192.168.2.6	172.67.206.204
Oct 11, 2024 13:45:06.439766884 CEST	49711	443	192.168.2.6	172.67.206.204
Oct 11, 2024 13:45:06.439791918 CEST	443	49711	172.67.206.204	192.168.2.6
Oct 11, 2024 13:45:06.439805984 CEST	49711	443	192.168.2.6	172.67.206.204
Oct 11, 2024 13:45:06.439812899 CEST	443	49711	172.67.206.204	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 11, 2024 13:45:03.908838987 CEST	62364	53	192.168.2.6	1.1.1.1
Oct 11, 2024 13:45:03.921672106 CEST	53	62364	1.1.1.1	192.168.2.6
Oct 11, 2024 13:45:03.926470041 CEST	60471	53	192.168.2.6	1.1.1.1
Oct 11, 2024 13:45:03.935458899 CEST	53	60471	1.1.1.1	192.168.2.6
Oct 11, 2024 13:45:04.041816950 CEST	53159	53	192.168.2.6	1.1.1.1
Oct 11, 2024 13:45:04.051970959 CEST	53	53159	1.1.1.1	192.168.2.6
Oct 11, 2024 13:45:04.053226948 CEST	65535	53	192.168.2.6	1.1.1.1
Oct 11, 2024 13:45:04.063097954 CEST	53	65535	1.1.1.1	192.168.2.6
Oct 11, 2024 13:45:04.167138100 CEST	58534	53	192.168.2.6	1.1.1.1
Oct 11, 2024 13:45:04.177642107 CEST	53	58534	1.1.1.1	192.168.2.6
Oct 11, 2024 13:45:04.191406012 CEST	56538	53	192.168.2.6	1.1.1.1
Oct 11, 2024 13:45:04.200674057 CEST	53	56538	1.1.1.1	192.168.2.6
Oct 11, 2024 13:45:04.216142893 CEST	54497	53	192.168.2.6	1.1.1.1
Oct 11, 2024 13:45:04.226700068 CEST	53	54497	1.1.1.1	192.168.2.6
Oct 11, 2024 13:45:04.227669954 CEST	56078	53	192.168.2.6	1.1.1.1
Oct 11, 2024 13:45:04.236187935 CEST	53	56078	1.1.1.1	192.168.2.6
Oct 11, 2024 13:45:04.237742901 CEST	65018	53	192.168.2.6	1.1.1.1
Oct 11, 2024 13:45:04.245610952 CEST	53	65018	1.1.1.1	192.168.2.6
Oct 11, 2024 13:45:05.489314079 CEST	50495	53	192.168.2.6	1.1.1.1
Oct 11, 2024 13:45:05.500901937 CEST	53	50495	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 11, 2024 13:45:03.908838987 CEST	192.168.2.6	1.1.1.1	0xc036	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 11, 2024 13:45:03.926470041 CEST	192.168.2.6	1.1.1.1	0x6a88	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 11, 2024 13:45:04.041816950 CEST	192.168.2.6	1.1.1.1	0xfb77	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 11, 2024 13:45:04.053226948 CEST	192.168.2.6	1.1.1.1	0x6935	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 11, 2024 13:45:04.167138100 CEST	192.168.2.6	1.1.1.1	0xbca	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 11, 2024 13:45:04.191406012 CEST	192.168.2.6	1.1.1.1	0xcf2b	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 11, 2024 13:45:04.216142893 CEST	192.168.2.6	1.1.1.1	0xfec7	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 11, 2024 13:45:04.227669954 CEST	192.168.2.6	1.1.1.1	0x6a97	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 11, 2024 13:45:04.237742901 CEST	192.168.2.6	1.1.1.1	0x8041	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 11, 2024 13:45:05.489314079 CEST	192.168.2.6	1.1.1.1	0xfe7a	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 11, 2024 13:45:03.921672106 CEST	1.1.1.1	192.168.2.6	0xc036	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 13:45:03.935458899 CEST	1.1.1.1	192.168.2.6	0x6a88	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 13:45:04.051970959 CEST	1.1.1.1	192.168.2.6	0xfb77	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 13:45:04.063097954 CEST	1.1.1.1	192.168.2.6	0x6935	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 13:45:04.177642107 CEST	1.1.1.1	192.168.2.6	0xbca	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 13:45:04.200674057 CEST	1.1.1.1	192.168.2.6	0xcf2b	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 13:45:04.226700068 CEST	1.1.1.1	192.168.2.6	0xfec7	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 13:45:04.236187935 CEST	1.1.1.1	192.168.2.6	0x6a97	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 13:45:04.245610952 CEST	1.1.1.1	192.168.2.6	0x8041	No error (0)	steamcommunity.com		23.192.247.89	A (IP address)	IN (0x0001)	false
Oct 11, 2024 13:45:05.500901937 CEST	1.1.1.1	192.168.2.6	0xfe7a	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false
Oct 11, 2024 13:45:05.500901937 CEST	1.1.1.1	192.168.2.6	0xfe7a	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

sergei-esenin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	23.192.247.89	443	2096	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 11:45:04 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-11 11:45:05 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 11 Oct 2024 11:45:05 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=dac87a6c63272387c8965f1e; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-11 11:45:05 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-11 11:45:05 UTC	10062	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-11 11:45:05 UTC	10261	IN	Data Raw: 74 3b 56 49 44 45 4f 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 76 69 64 65 6f 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 4d 4d 55 4e 49 54 59 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 6f 6d 6d 75 6e 69 74 79 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 4d 4d 55 4e 49 54 59 5f 43 44 4e 5f 41 53 53 45 54 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 Data Ascii: t;VIDEO_CDN_URL":"https:\/\/video.akamai.steamstatic.com\/","COMMUNITY_CDN_URL":"https:\/\/community.akamai.steamstatic.com\/","COMMUNITY_CDN_ASSET_URL":"https:\/\/cdn.akamai.steamstatic.com\/steamcommunit

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	172.67.206.204	443	2096	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 11:45:05 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-11 11:45:05 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-11 11:45:06 UTC	825	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 11:45:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4ui2719pho2auj5p5bikg38tc0; expires=Tue, 04 Feb 2025 05:31:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6G9RdNvNN7nHQKjRsRRdYWO3X0ni4OCI5Q8JtCFHjn%2BrEpkNETr23Js2FvaummPKX6TGCbvvgfUTKc414rlp8ss2JYnPfK7BoXhPJKj3rpDWlXB33%2Bht8UY77Yc1QBZRBR0yRw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d0e9a1cd9ef1971-EWR alt-svc: h3=":443"; ma=86400
2024-10-11 11:45:06 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-11 11:45:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	07:45:01
Start date:	11/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb90000
File size:	1'863'168 bytes
MD5 hash:	D28A43B3DBCE6278477CC5696847850A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	55.1%
Total number of Nodes:	49
Total number of Limit Nodes:	5

Executed Functions

Function 00BD50FA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(19A41BB1,00000000,00000800), ref: 00BD5182

Strings

<I$), xrefs: 00BD5198
@^, xrefs: 00BD5120
<I$), xrefs: 00BD52E3

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: <I$)$<I$)$@^
API String ID: 1029625771-935358343
Opcode ID: 7e043b0026ae88153263b06c0d5095e39d176f224b2194957846830d1e549952
Instruction ID: 2c7c233b9e9f89b757a7d9f4a4d6d809faa653e82f54261a620f571417ca9d45
Opcode Fuzzy Hash: 7e043b0026ae88153263b06c0d5095e39d176f224b2194957846830d1e549952
Instruction Fuzzy Hash: 28216D351083848FC310DF68D8D5B6AFBF4AB6A300F69482CE1C5D7352EB76D9158B56

Function 00B9FCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

t, xrefs: 00B9FCBE
VY^_, xrefs: 00B9FDFF
J|BJ, xrefs: 00BA000D
V, xrefs: 00B9FEDC

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: J|BJ$V$VY^_$t
API String ID: 0-3701112211
Opcode ID: e3270ea75323cfb1b6ed05033f02c94c74dcc671b3b218b2fe75fb420adec000
Instruction ID: a7760e4e734d9a6812724e5d1064da9bf1a6143cf84d3ec0146453eccf2d73a1
Opcode Fuzzy Hash: e3270ea75323cfb1b6ed05033f02c94c74dcc671b3b218b2fe75fb420adec000
Instruction Fuzzy Hash: EAD1787551C3819BD710EF18949066FBBE1EF96B44F1888ACF4C99B252C336CD09DB92

Function 00B9D110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 00B9D2F0

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 9590ec2d0fe6ab953c9cafc49c0861f408aa2d132815b1ce56ec76831c9da2ec
Instruction ID: fd076657b85f0a1d20b4586029053e420d594f35409b724331f8907a9c42dbc6
Opcode Fuzzy Hash: 9590ec2d0fe6ab953c9cafc49c0861f408aa2d132815b1ce56ec76831c9da2ec
Instruction Fuzzy Hash: 8B41357440D340ABCB01BB69D684A2EFBF5EF52745F548CACE5C49B212C336D8148B6B

Function 00BD5BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00BD973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 00BD5BDE

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00BD695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 00BD69C5

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 128d52a88ef26d4d08faf7e63341295aefedbd63f7df747b3eee3c950d18c52e
Instruction ID: 6e937cdd51005cef77aba83a4e2468a4a4cd93feb4ae1ad6d16098bcd100b2c3
Opcode Fuzzy Hash: 128d52a88ef26d4d08faf7e63341295aefedbd63f7df747b3eee3c950d18c52e
Instruction Fuzzy Hash: 263188B15183019FD718DF14C8A072AF7F1EF95344F48985EE5C69B3A1E7389904CB56

Function 00BA049B Relevance: .3, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa2fa2cb385b118f3936e9ff59abfd283ca670149b8ca21d4dc3cbcb1c2f72e4
Instruction ID: cd43bf98cce314cc3ecc129f589ab16f3f9823a058c9b7238e5c5311406dff00
Opcode Fuzzy Hash: aa2fa2cb385b118f3936e9ff59abfd283ca670149b8ca21d4dc3cbcb1c2f72e4
Instruction Fuzzy Hash: 13918C75205B01CFD724CF25E894A27B7F6FF89310F158A6DE8568BAA1EB30E815CB50

Function 00BA0228 Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bacc08c60371a6e5944a0cf8cf0119ec7dbf7446f936b42426eb7b361fe1bb28
Instruction ID: c09fe323faf700f1ca25199b3718ffe94a386f072e2ea43486a9c51b49b68615
Opcode Fuzzy Hash: bacc08c60371a6e5944a0cf8cf0119ec7dbf7446f936b42426eb7b361fe1bb28
Instruction Fuzzy Hash: E3718C74209701DFD7248F20EC94B26B7F6FF4A310F1089ADE8468BA62DB31E815CB50

Function 00BD99D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b62ede25f0451f0f1d03d04d9e8bbf6f451330be779608a0a2c1d5365fb782e8
Instruction ID: b61e95f7d4d5e7814feaedbb864a54ce95a9c3578c8431f81059567dab53d1c8
Opcode Fuzzy Hash: b62ede25f0451f0f1d03d04d9e8bbf6f451330be779608a0a2c1d5365fb782e8
Instruction Fuzzy Hash: AE419F35208340ABD7249E15D990B2BF7E5EB85714F1588AEE5C99B351E331EC11CB62

Function 00BD63B8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5788ce1dbff18b7d53d1298e805162726ef434957c80de1dcc2c7d97cd963489
Instruction ID: 8f99731e95ce221d194131581d525b55e831d5a079a21e308a8ad7bc2e2ccd87
Opcode Fuzzy Hash: 5788ce1dbff18b7d53d1298e805162726ef434957c80de1dcc2c7d97cd963489
Instruction Fuzzy Hash: 6631F274249301BAD624DB08CD82F3AF7E1EB80B25F64854DF1C15B3E1E770AC118B56

Function 00BA0EEC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bcab804f89f8f19067f5ffcbec3abbf2e1d054f0c7ac774d19c0f0a5f4d3a60
Instruction ID: 0eb71572923485b61ab29f390559ea5ccf07c3b42a358c5c12434d29ddba4d4e
Opcode Fuzzy Hash: 7bcab804f89f8f19067f5ffcbec3abbf2e1d054f0c7ac774d19c0f0a5f4d3a60
Instruction Fuzzy Hash: 86213AB4A0425A9FDB15CF94CC90BBEBBB1FF4A304F144859E911BB392C735A901CB64

Function 00BD3220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00BD32A6

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 412ac1cf11743f5aa549301c9f55d22089829c80daa3cc96a2030502a2d16248
Instruction ID: e3993614c9f0f928df8ea407cc914c1b4bade5abc5a23c62e917b7b9fb89e3c7
Opcode Fuzzy Hash: 412ac1cf11743f5aa549301c9f55d22089829c80daa3cc96a2030502a2d16248
Instruction Fuzzy Hash: EB016D3490D2909BC701EF18E889A1AFBE8EF4AB00F05485CE5C58B361D735DD60CB96

Function 00BD3202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00BD3208

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f3d728dec9a284381affb13234c336ac69f2fb715332cb6313670390c4d17850
Instruction ID: 803b0b7270710a28090d12d975eed0d9247b3ca7213297581810a0b6a7e43204
Opcode Fuzzy Hash: f3d728dec9a284381affb13234c336ac69f2fb715332cb6313670390c4d17850
Instruction Fuzzy Hash: 19B012301400005FDA041B00EC0AF043510EB00606F800050A1000D0B1D5B15C64C554

Non-executed Functions

Function 00BC23E0 Relevance: 33.0, APIs: 4, Strings: 13, Instructions: 3298COMMON

Download Yara Rule

Strings

|}&C, xrefs: 00BC2F21
`tii, xrefs: 00BC2693
:, xrefs: 00BC32DD
3<, xrefs: 00BC32D6
f@~!, xrefs: 00BC25FF
aenQ, xrefs: 00BC276A
#v, xrefs: 00BC344B, 00BC4861
{l`~, xrefs: 00BC268C
ggxz, xrefs: 00BC2685
fedc, xrefs: 00BC2782
Cx, xrefs: 00BC453D
%*+(, xrefs: 00BC40EF
mlc@, xrefs: 00BC275C

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: %*+($3<$:$Cx$`tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~$|}&C$#v
API String ID: 0-2260822535
Opcode ID: 6473596682501d3b3ca1a386b37a5c8565efbe8c20834428a0454053afcb8c9c
Instruction ID: 030d8b322273e5a636eff3475f7ce7fe0d92b9ac0aad616dac967d2d97420a2c
Opcode Fuzzy Hash: 6473596682501d3b3ca1a386b37a5c8565efbe8c20834428a0454053afcb8c9c
Instruction Fuzzy Hash: 6C338A70504B818FD7258F38C590B62BBE1FF16704F58899DE4DA8BB92C735E906CBA1

Function 00BADB6F Relevance: 32.0, Strings: 24, Instructions: 2006COMMON

Download Yara Rule

Strings

89>?, xrefs: 00BAE9F6
AR, xrefs: 00BADD10
<=:;, xrefs: 00BAE930
tsrq, xrefs: 00BAE6FC
`onm, xrefs: 00BAE733
|, xrefs: 00BAECB1
()./, xrefs: 00BAE9CA
`Y^_, xrefs: 00BAE99E
tuJK, xrefs: 00BAE967
dcba, xrefs: 00BAE728
WP, xrefs: 00BADCEF
@ONM, xrefs: 00BAE6DB
%*+(, xrefs: 00BADE37, 00BADE46
xgfe, xrefs: 00BAE71D
mjkh, xrefs: 00BAE7D8
T, xrefs: 00BAF157
QNOL, xrefs: 00BAE775
LKJI, xrefs: 00BAE6E6
:WUE, xrefs: 00BAF6B7, 00BAF6C6
<=2, xrefs: 00BAEA01
lkji, xrefs: 00BAE73E
DCBA, xrefs: 00BAE887, 00BAE896
89&', xrefs: 00BAE93B
D, xrefs: 00BAE846

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+($()./$89&'$89>?$:WUE$<=2$<=:;$@ONM$AR$D$DCBA$LKJI$QNOL$T$WP$`Y^_$`onm$dcba$lkji$mjkh$tsrq$tuJK$xgfe$|
API String ID: 2994545307-1418943773
Opcode ID: 94b4e7e24389d16d8a9b64629585155b684e78a7ba4f62e1630000884988f1ab
Instruction ID: 66f45603e2b95835f95e85ba56704df11ed9e2937db24cbb371909a1857c1446
Opcode Fuzzy Hash: 94b4e7e24389d16d8a9b64629585155b684e78a7ba4f62e1630000884988f1ab
Instruction Fuzzy Hash: A9F278B050C3829BD770CF14C494BABBBE2EFD6304F5448ADE4D98B251EB719984CB92

Function 00BB9F62 Relevance: 21.7, Strings: 17, Instructions: 473COMMON

Download Yara Rule

Strings

WQ, xrefs: 00BBA62B
/), xrefs: 00BBA66D
?m,o, xrefs: 00BBA13C
Gt, xrefs: 00BB9FF8
hi, xrefs: 00BBAB9D
_Y, xrefs: 00BBA641
WH, xrefs: 00BBAA1C
%e6g, xrefs: 00BBA152
N[, xrefs: 00BBA375
kW, xrefs: 00BBA380
]{, xrefs: 00BBA1E7, 00BBA1F3
sm, xrefs: 00BBA830
=], xrefs: 00BBA36A
CG, xrefs: 00BBAA32
(a*c, xrefs: 00BBA147
JG, xrefs: 00BBAA27
S], xrefs: 00BBA636

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: %e6g$(a*c$=]$?m,o$CG$Gt$JG$N[$WH$]{$hi$kW$/)$S]$WQ$_Y$sm
API String ID: 0-1131134755
Opcode ID: 65c528b25f5e236782d4d2206b3526a8499b97f7afac6c1eae80fe928db288e7
Instruction ID: 38a6389aac161517c08622e9b670165aa7d7fa4b750672acd33ffbdb1d7630f4
Opcode Fuzzy Hash: 65c528b25f5e236782d4d2206b3526a8499b97f7afac6c1eae80fe928db288e7
Instruction Fuzzy Hash: 9A52B6B444D3858AE270CF26D581B9EBAF1BB92740F608E1DE1ED9B255DBB08045CF93

Function 00BB9510 Relevance: 20.4, Strings: 16, Instructions: 427COMMON

Download Yara Rule

Strings

?M0K, xrefs: 00BB9968
G'M!, xrefs: 00BB9ADB
;IJK, xrefs: 00BB983E
L3Y=, xrefs: 00BB9B03
!E4G, xrefs: 00BB9836
,A&C, xrefs: 00BB982E
B?Q9, xrefs: 00BB9B0B
X/R), xrefs: 00BB9AEB
O+f), xrefs: 00BB9634, 00BB963D
2A"_, xrefs: 00BB9980
8;, xrefs: 00BB9B13
T#a-, xrefs: 00BB9AE3
G+X5, xrefs: 00BB9AF3
B7U1, xrefs: 00BB9AFB
z=Q?, xrefs: 00BB9826
pq, xrefs: 00BB99E0

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: 199869c336b81e295fe4b683b952170eaf7cc004c3c506b07a4cb0e55a220fbc
Instruction ID: bc4f2bde178a97cd0104bccd6f0ff27fe54027c0310c793a78206a09682bca36
Opcode Fuzzy Hash: 199869c336b81e295fe4b683b952170eaf7cc004c3c506b07a4cb0e55a220fbc
Instruction Fuzzy Hash: 8EF14EB0518380ABD310DF15D881A6BBBF4FB86B48F444D5CF5D99B252D3B4D908CBA6

Function 00BBDD29 Relevance: 14.9, Strings: 11, Instructions: 1142COMMON

Download Yara Rule

Strings

,Q?S, xrefs: 00BBE26F
hX]N, xrefs: 00BBDDC7
Y9N;, xrefs: 00BBE245
%*+(, xrefs: 00BBE143
upH}, xrefs: 00BBDE8A, 00BBE798, 00BBDF4A
=]+_, xrefs: 00BBE276
n\+H, xrefs: 00BBDDC0
{E, xrefs: 00BBE323
)IgK, xrefs: 00BBE261
-M2O, xrefs: 00BBE25A
<Y.[, xrefs: 00BBE27D

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: %*+($)IgK$,Q?S$-M2O$<Y.[$=]+_$Y9N;$hX]N$n\+H$upH}${E
API String ID: 0-1557708024
Opcode ID: 0c6485e8c4a3e998075da0f64a62051deb6d7ad042bdb9d01943a904e30c38ac
Instruction ID: 18e2e39d866b1429be1e8e24d7bdcdc21c18d4b115d3d143aaecd18f3e597783
Opcode Fuzzy Hash: 0c6485e8c4a3e998075da0f64a62051deb6d7ad042bdb9d01943a904e30c38ac
Instruction Fuzzy Hash: 2892DE71E00245CFDB14CF68D8816AEBBF2FF49310F2981A8E456AB3A1D775AD41CB90

Function 00D5B2E9 Relevance: 14.2, Strings: 10, Instructions: 1656COMMON

Download Yara Rule

Strings

fsz, xrefs: 00D5BE5C
Bz, xrefs: 00D5BB79
RRo_, xrefs: 00D5B9B1
xn%#, xrefs: 00D5B5E4
"=;, xrefs: 00D5C0E2
gc{, xrefs: 00D5C2B0
^'G?, xrefs: 00D5B5DF
ezw, xrefs: 00D5B6F9
#;}u, xrefs: 00D5B743
:B~>, xrefs: 00D5B8EB

Memory Dump Source

Source File: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: "=;$#;}u$:B~>$Bz$RRo_$^'G?$ezw$fsz$xn%#$gc{
API String ID: 0-250507521
Opcode ID: 57a75fa49c6df039e8e3020e5b4a321baf68fd3eeee067c180287eca5fccd657
Instruction ID: 1c9ccc3c507cac0163d885fbdfa3d18ff272b3c2e2669af35ee0c128c304d668
Opcode Fuzzy Hash: 57a75fa49c6df039e8e3020e5b4a321baf68fd3eeee067c180287eca5fccd657
Instruction Fuzzy Hash: 3CB22BF3A082009FE3146E2DDC8567AFBE6EFD4720F1A863DE6C4D7744EA3558058692

Function 00BB098B Relevance: 10.8, Strings: 8, Instructions: 836COMMON

Download Yara Rule

Strings

cah`, xrefs: 00BB107E
9.5^, xrefs: 00BB0F9F
&> &, xrefs: 00BB0F89
gce/, xrefs: 00BB1073
%*+(, xrefs: 00BB0A77, 00BB0A86
qrqp, xrefs: 00BB1089
,#15, xrefs: 00BB0F94
{, xrefs: 00BB1502

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: %*+($&> &$,#15$9.5^$cah`$gce/$qrqp${
API String ID: 0-4102007303
Opcode ID: 8c23f5342319b6749bf7d695928f6dcba0353bbb6f7ee90c32dff41043b9c459
Instruction ID: 61ccb91b5d89685a47866f9766ec2ddd9384b1b6704779d54b24fcdf302de6f2
Opcode Fuzzy Hash: 8c23f5342319b6749bf7d695928f6dcba0353bbb6f7ee90c32dff41043b9c459
Instruction Fuzzy Hash: 9862A9B16183818BD730DF18D891BABBBE1FF96314F084D6DE49A8B641E7B59840CB53

Function 00B91000 Relevance: 10.5, Strings: 7, Instructions: 1785COMMON

Download Yara Rule

Strings

0123456789ABCDEFXP, xrefs: 00B9157D, 00B915EB
@, xrefs: 00B92C40
-, xrefs: 00B921ED
0123456789abcdefxp, xrefs: 00B91587, 00B915F8
gfff, xrefs: 00B922E1
gfff, xrefs: 00B92226
gfff, xrefs: 00B92297

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$@$gfff$gfff$gfff
API String ID: 0-2517803157
Opcode ID: 2a7c484a1edb902fae9a35e42338950340f4ca623666db74a752173b507661ec
Instruction ID: 36838df2e51a2e8a716cd7ca2e06d7fc6502b8c97122a17c3caec3ef33a1e059
Opcode Fuzzy Hash: 2a7c484a1edb902fae9a35e42338950340f4ca623666db74a752173b507661ec
Instruction Fuzzy Hash: A0D2D371A083529FDB18CF28C49436ABBE2EFD5314F188ABDE49987391D734D945CB82

Function 00D621F2 Relevance: 8.8, Strings: 6, Instructions: 1282COMMON

Download Yara Rule

Strings

!%=o, xrefs: 00D6288D
2{, xrefs: 00D6245B
[3_, xrefs: 00D627F7
AGn, xrefs: 00D6292D
=/, xrefs: 00D62514
'k/, xrefs: 00D6261E

Memory Dump Source

Source File: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: !%=o$2{$AGn$[3_$'k/$=/
API String ID: 0-4186158839
Opcode ID: 7b81d73b601ecb763c082b6fb16ef3d3a73fb024a416562dc17d81535d692d57
Instruction ID: d5d2a784b9a2234e3b080708dfe9a9af92af9b383513611b7771c4ade09c2ca8
Opcode Fuzzy Hash: 7b81d73b601ecb763c082b6fb16ef3d3a73fb024a416562dc17d81535d692d57
Instruction Fuzzy Hash: 238205F360C2049FE304AF29EC8567AFBE9EF94720F16893DE6C4C7344EA3558458696

Function 00D51280 Relevance: 7.9, Strings: 5, Instructions: 1658COMMON

Download Yara Rule

Strings

48, xrefs: 00D51EAF
>$, xrefs: 00D5174D
AR;}, xrefs: 00D516B5
|O, xrefs: 00D51C0C
lK}, xrefs: 00D51BE4

Memory Dump Source

Source File: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: AR;}$|O$>$$lK}$48
API String ID: 0-3886521666
Opcode ID: 06306217f99e81680e39bec5a7cfc545128a1c22f25180d31c6e23593c49c4ef
Instruction ID: 241eef648a6d6615120478e144f7aa17aa0a281ee5869f600e72b7aa3ed464e2
Opcode Fuzzy Hash: 06306217f99e81680e39bec5a7cfc545128a1c22f25180d31c6e23593c49c4ef
Instruction Fuzzy Hash: FEB226F360C204AFE3046E2DEC8567AFBE9EF94720F164A3DEAC4C3744E67558058696

Function 00B912F7 Relevance: 7.2, Strings: 5, Instructions: 922COMMON

Download Yara Rule

Strings

i, xrefs: 00B928EA
0, xrefs: 00B91E88
@, xrefs: 00B93531
0, xrefs: 00B9243E
0, xrefs: 00B91DC1

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: d9542b282d7fd5990e1afff9a96f6444b84b1cc814ebc960ca0ec7d13215175a
Instruction ID: d8d012ce33ac16d00980b82cfa52bfb7ae6658f8e08cc91316a2f56c4e1e5023
Opcode Fuzzy Hash: d9542b282d7fd5990e1afff9a96f6444b84b1cc814ebc960ca0ec7d13215175a
Instruction Fuzzy Hash: 3D62C271A0C3829BDB19CF28C49076ABBE1EF95304F188DBDE8D987291D774D945CB82

Function 00B9164F Relevance: 6.7, Strings: 5, Instructions: 472COMMON

Download Yara Rule

Strings

0123456789ABCDEFXP, xrefs: 00B9164F
+, xrefs: 00B91573
gfff, xrefs: 00B91F3C
gfff, xrefs: 00B91F57
0123456789abcdefxp, xrefs: 00B91659

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: +$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-1123320326
Opcode ID: 5383ccb09c498db82ee5725c5f125e6f8fb8932af963670ee0d1255f5828deed
Instruction ID: af364915c6e537b999b6f9b5640ddd82350568e0e2c6aaf243bda8c892e9ab19
Opcode Fuzzy Hash: 5383ccb09c498db82ee5725c5f125e6f8fb8932af963670ee0d1255f5828deed
Instruction Fuzzy Hash: 4EF19331A0C3819FCB15CF29C49426AFBE1ABD9304F18CAADE4D987352D734D945DB92

Function 00B913A3 Relevance: 6.6, Strings: 5, Instructions: 390COMMON

Download Yara Rule

Strings

0123456789ABCDEFXP, xrefs: 00B913A3
gfff, xrefs: 00B91F3C
-, xrefs: 00B91F23
gfff, xrefs: 00B91F57
0123456789abcdefxp, xrefs: 00B913AD

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-3620105454
Opcode ID: 57fc59326ba70456c357bff6655502054054fd80da9e5b956e5a4a2ba1792f98
Instruction ID: b32f4cb3eb57ec083e72f85edd9427665c1cc4879da1396ca764baee27d4369e
Opcode Fuzzy Hash: 57fc59326ba70456c357bff6655502054054fd80da9e5b956e5a4a2ba1792f98
Instruction Fuzzy Hash: DFD17E356087829FCB15CF29C48426AFBE2ABD9304F08CAADE4D987356D634D949CB52

Function 00D5E81F Relevance: 6.6, Strings: 4, Instructions: 1617COMMON

Download Yara Rule

Strings

T5Z, xrefs: 00D5F29C
s%u, xrefs: 00D5FA07
W[ \, xrefs: 00D5EBAD
_, xrefs: 00D5F81B

Memory Dump Source

Source File: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: T5Z$W[ \$ _$s%u
API String ID: 0-2019073790
Opcode ID: 2dbea3ec6fc30fc2625be22b78499056a36e08d7cb4aa339573b69c2df3d95df
Instruction ID: 5c795f36594292884580cc461b7d63acaeec85b2611725180f560f4aefb777b4
Opcode Fuzzy Hash: 2dbea3ec6fc30fc2625be22b78499056a36e08d7cb4aa339573b69c2df3d95df
Instruction Fuzzy Hash: 56B2F6F3608204AFE304AE2DEC8567AF7E9EF94720F1A453DEAC5C3740EA3559058696

Function 00BBFD10 Relevance: 5.7, Strings: 4, Instructions: 667COMMON

Download Yara Rule

Strings

:, xrefs: 00BC0087
m1s3, xrefs: 00BBFEC3, 00BBFECB
uvw, xrefs: 00BBFE95
NA_I, xrefs: 00BC036D

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: :$NA_I$m1s3$uvw
API String ID: 0-3973114637
Opcode ID: 7717c1e47f2c6a07019688ec77de45e732d8ed3bd9f068185cee8165f0e7e653
Instruction ID: 39e7cd494d54ab88171fb7f067fb3e9e9ac17c16ea888592b46004104eecef75
Opcode Fuzzy Hash: 7717c1e47f2c6a07019688ec77de45e732d8ed3bd9f068185cee8165f0e7e653
Instruction Fuzzy Hash: 303298B0518381DFD311EF28D880B2ABBE5EB8A344F144EACF5D58B2A2D735D945CB52

Function 00BA3BE2 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00BA3EC4
;z, xrefs: 00BA3C87
p, xrefs: 00BA3C80
ss, xrefs: 00BA3C79

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: %*+($;z$p$ss
API String ID: 0-2391135358
Opcode ID: 5962925b52c6b895b8478ddfbdf200495fca94714b4ba5ebf4c147cf08fae644
Instruction ID: 081f805b348e8d6f1335aaa637d7ba1573e0e01dcf693d9251c82f790a07a162
Opcode Fuzzy Hash: 5962925b52c6b895b8478ddfbdf200495fca94714b4ba5ebf4c147cf08fae644
Instruction Fuzzy Hash: BB026CB4810700EFD760DF24D986756BFF4FB02700F50899DE89A9B656E731E819CBA2

Function 00D6029E Relevance: 5.4, Strings: 3, Instructions: 1636COMMON

Download Yara Rule

Strings

C{, xrefs: 00D61467
kQ+_, xrefs: 00D6126F
VF.W, xrefs: 00D60A05

Memory Dump Source

Source File: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: C{$VF.W$kQ+_
API String ID: 0-2507686725
Opcode ID: 1e2e7ef0fcce3f89974c8486265ba6b6309fd95ab3491c8723951fdf39e96b24
Instruction ID: 2b09699de7aafc3ead24a7a7e1fe8f7e0b1fee6bde2612a1438b55225806e889
Opcode Fuzzy Hash: 1e2e7ef0fcce3f89974c8486265ba6b6309fd95ab3491c8723951fdf39e96b24
Instruction Fuzzy Hash: 53B219F360C2049FE3046E2DEC8567ABBDAEFD4720F1A893DE6C4C7744EA3558058696

Function 00BB2260 Relevance: 5.4, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

a|, xrefs: 00BB2317
hu, xrefs: 00BB232F
sj, xrefs: 00BB2327
lc, xrefs: 00BB2507

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: a|$hu$lc$sj
API String ID: 0-3748788050
Opcode ID: 10388a9e91e79e6fc510709721a2dfe432f92c93e78ecb7b8109e1de287d2508
Instruction ID: 7388dfb17bf49da1fb9f8627993c780e23de3532525a29c05df49afd33f60fd6
Opcode Fuzzy Hash: 10388a9e91e79e6fc510709721a2dfe432f92c93e78ecb7b8109e1de287d2508
Instruction Fuzzy Hash: E5A179744083418BC720DF18C891A6BB7F0FFA6354F588A4CE8D59B391E3B9D941CBA6

Function 00D52E0D Relevance: 5.4, Strings: 3, Instructions: 1601COMMON

Download Yara Rule

Strings

8}{, xrefs: 00D53187
~3oY, xrefs: 00D540C2
7\,, xrefs: 00D537BD

Memory Dump Source

Source File: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: 7\,$8}{$~3oY
API String ID: 0-2984709647
Opcode ID: b7f08d321b764de059f9ed6118e551f22a0503cd148c4d92c5d3a75f39c44a63
Instruction ID: fe224f5d992422c66a58b27b736f2397d4dee2d2f677e0e2882ca3b793c91e47
Opcode Fuzzy Hash: b7f08d321b764de059f9ed6118e551f22a0503cd148c4d92c5d3a75f39c44a63
Instruction Fuzzy Hash: 30B215F36082049FE304AE2DEC8577ABBE5EF94720F1A893DE6C4C7744EA3558058697

Function 00D5992A Relevance: 5.3, Strings: 3, Instructions: 1563COMMON

Download Yara Rule

Strings

'pH, xrefs: 00D5A6AD
JCwf, xrefs: 00D5A894
{Cp#, xrefs: 00D59D8F

Memory Dump Source

Source File: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: 'pH$JCwf${Cp#
API String ID: 0-1034368586
Opcode ID: 6124d4c1bc3aaaf9c14a524cf12b8c526fa89f8bbfb22e776ef4cbb7ca5ebf4b
Instruction ID: 66bc60ee930554023c66fe3bbdce11d819ce0561d9df302f3a038cf4874fa330
Opcode Fuzzy Hash: 6124d4c1bc3aaaf9c14a524cf12b8c526fa89f8bbfb22e776ef4cbb7ca5ebf4b
Instruction Fuzzy Hash: 6FA208F3A0C200AFE304AE29EC8567AB7E9EF94720F16453DEAC5C7344E67598118697

Function 00BBD7AF Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

#', xrefs: 00BBD9EA
T>, xrefs: 00BBD984
CV, xrefs: 00BBD98B
KV, xrefs: 00BBD97D

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: #'$CV$KV$T>
API String ID: 0-95592268
Opcode ID: fb7359b74e8b73cd6a95400d940819203dfed8dd6f2758a774de258d667afe2e
Instruction ID: 081625f9e80793a72e1f1b6f54532f32ff9facd5b1156dc9132fc7d3fdf94e11
Opcode Fuzzy Hash: fb7359b74e8b73cd6a95400d940819203dfed8dd6f2758a774de258d667afe2e
Instruction Fuzzy Hash: D78186B48017469BCB20DF95C2855AEBFF1FF02300F204A0CE486ABA45D374AA55CFE2

Function 00BBAC91 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

,{*y, xrefs: 00BBAD07, 00BBAD13
4c2a, xrefs: 00BBACA9
(g6e, xrefs: 00BBACA1
lk, xrefs: 00BBACBC

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: (g6e$,{*y$4c2a$lk
API String ID: 0-1327526056
Opcode ID: 626e96baf52fe1b55d37eb1c85fece5684b101ea515612c3030f8a2d40737e2d
Instruction ID: 40dc9fb442e2a59036d5e1c1fb13bb68bd5cf9ebb6a86a6b9cb0330becfbd9dd
Opcode Fuzzy Hash: 626e96baf52fe1b55d37eb1c85fece5684b101ea515612c3030f8a2d40737e2d
Instruction Fuzzy Hash: C84175B4808381CBD7209F24D940BABB7F0FF86305F5459ADE5C89B261EB71D944CB96

Function 00BBC470 Relevance: 4.2, Strings: 3, Instructions: 419COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00BBC9E4, 00BBC9ED
~/i!, xrefs: 00BBC537
%*+(, xrefs: 00BBC8C3, 00BBC8CB

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: %*+($%*+($~/i!
API String ID: 0-4033100838
Opcode ID: d8a8e9d8abd2ff7ac5ac4cba9753218c25531d6eba829ce8fde44e23cce670c9
Instruction ID: 0a86abb67b0e6fb18d125c32940e86f0b944889cf8ebe3670f08cdfeb8959c20
Opcode Fuzzy Hash: d8a8e9d8abd2ff7ac5ac4cba9753218c25531d6eba829ce8fde44e23cce670c9
Instruction Fuzzy Hash: 5CE185B5519380DFE720DF28D881B6ABBE5FB85344F588C6CE5C98B251EB71D810CB92

Function 00B98590 Relevance: 4.1, Strings: 3, Instructions: 387COMMON

Download Yara Rule

Strings

), xrefs: 00B98616
), xrefs: 00B9860C
IEND, xrefs: 00B989F0

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 4db8e0525cd641a0d1f901603876a7643e1c156f3772d3b59ac4974aa743468c
Instruction ID: 60500199474cb041e2b07c35f83a49b331cbe2900b56ff05aa57be88dca6378c
Opcode Fuzzy Hash: 4db8e0525cd641a0d1f901603876a7643e1c156f3772d3b59ac4974aa743468c
Instruction Fuzzy Hash: C8E1CFB1A087059FEB10CF28C88172ABBE0FB95314F14497DE5999B392DB75E914CBC2

Function 00D5CE41 Relevance: 4.1, Strings: 2, Instructions: 1560COMMON

Download Yara Rule

Strings

DXN, xrefs: 00D5DD62
4c[w, xrefs: 00D5DA46

Memory Dump Source

Source File: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: 4c[w$DXN
API String ID: 0-3091199229
Opcode ID: d8d596a75e9e63e90c8a9f4e87b26f00af8127e17530e22a3f37a3cc0e69649c
Instruction ID: b730049e4b3c41434e628b7d4398b6252f3421f9f717e963c2266a526343d001
Opcode Fuzzy Hash: d8d596a75e9e63e90c8a9f4e87b26f00af8127e17530e22a3f37a3cc0e69649c
Instruction Fuzzy Hash: 65B2F5F3A0C6109FE3046E29EC8567AFBE5EF94720F1A893DEAC483744E63558058797

Function 00D4E535 Relevance: 3.5, Strings: 2, Instructions: 1012COMMON

Download Yara Rule

Strings

%Ju, xrefs: 00D4EE64
{z, xrefs: 00D4E8AE

Memory Dump Source

Source File: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: %Ju${z
API String ID: 0-1876609873
Opcode ID: f97ba4501f9cc7fdeff159222b18e8f8be40a756ca0c15c553a4247072e681a7
Instruction ID: fb1862cafbb2d704075a193ecf8d216e43ed72cdbd97c194aa5bf0faf953f725
Opcode Fuzzy Hash: f97ba4501f9cc7fdeff159222b18e8f8be40a756ca0c15c553a4247072e681a7
Instruction Fuzzy Hash: 166219F3A0C6049FE3146E6DEC8567AFBE9EF94320F164A3DE6C4C7744E63598018692

Function 00D4C927 Relevance: 3.4, Strings: 2, Instructions: 916COMMON

Download Yara Rule

Strings

cjZ, xrefs: 00D4D0B3
R>p(, xrefs: 00D4CFCD

Memory Dump Source

Source File: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: R>p($cjZ
API String ID: 0-461656703
Opcode ID: c9412599e86f1acba531cd4bbbe76f8b7a1429c958cfe381749cafa8d3716bea
Instruction ID: c3dbc2f2db306170bd410e5b93415840919bccd447c344fff9c54c4d06df8884
Opcode Fuzzy Hash: c9412599e86f1acba531cd4bbbe76f8b7a1429c958cfe381749cafa8d3716bea
Instruction Fuzzy Hash: CE524BF390C304AFD7046E2DEC8567ABBE9EF94720F1A463DE6C4C7744EA3598058686

Function 00BD4040 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

f, xrefs: 00BD420C
%*+(, xrefs: 00BD40A4, 00BD40AD

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: e817777ab5a716ef9e1f4a7ecd987152ee1eaea9685a0b389eb82c74943374f4
Instruction ID: c898861bb73bab251c9e76434a7d9bdda7fe9505b28fb7753eb08d842edfa285
Opcode Fuzzy Hash: e817777ab5a716ef9e1f4a7ecd987152ee1eaea9685a0b389eb82c74943374f4
Instruction Fuzzy Hash: BA129B756083419FC714CF18C880B2AFBE2FB89314F188AAEF5959B391E771D945CB92

Function 00BCF620 Relevance: 3.0, Strings: 2, Instructions: 461COMMON

Download Yara Rule

Strings

dg, xrefs: 00BCF7F5
hi, xrefs: 00BCF6E6

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: dg$hi
API String ID: 0-2859417413
Opcode ID: fc35b229558fadfdd5d83e3b4c0af97ac72f440ce06640fd43372616bf6bbf6e
Instruction ID: 6108907866bcb99118a998240281ddd4ff7fda28a0e649754cee999f1b5ecbe4
Opcode Fuzzy Hash: fc35b229558fadfdd5d83e3b4c0af97ac72f440ce06640fd43372616bf6bbf6e
Instruction Fuzzy Hash: 55F19371618342EFE704CF24D891B2ABBF6FB86345F1499ACF0958B2A1CB34D945CB52

Function 00B935B0 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

Inf, xrefs: 00B93607
NaN, xrefs: 00B9360E

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: fac3d30ef34f870e16ffedc5c03a155bf363ac37bb41ac79daf1815b14a76a76
Instruction ID: d9ed0cac6423e2b1f01b9609ed1512baafd864e348dc066351019f87712dfb6c
Opcode Fuzzy Hash: fac3d30ef34f870e16ffedc5c03a155bf363ac37bb41ac79daf1815b14a76a76
Instruction Fuzzy Hash: CCD1E671A183119BCB04CF29C8C061EFBE1EBC8B50F158A7DF999973A0E675DD058B82

Function 00D56366 Relevance: 2.8, Strings: 1, Instructions: 1579COMMON

Download Yara Rule

Strings

5FJ_, xrefs: 00D56839

Memory Dump Source

Source File: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: 5FJ_
API String ID: 0-1675939095
Opcode ID: 0e3fec6fc76b6a909579bc91e97cd4014399d49c82f57401d8eecb16b07287e1
Instruction ID: 874ef6ff11716f5f55522bfc5821c5665cc7fc8be763e8bf92c22f1f67c454d0
Opcode Fuzzy Hash: 0e3fec6fc76b6a909579bc91e97cd4014399d49c82f57401d8eecb16b07287e1
Instruction Fuzzy Hash: ABB2F4F3A08200AFE3046E2DEC4567AFBE9EF94720F1A893DE6C487744E63558458797

Function 00BAFFDF Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

Ye[g, xrefs: 00BB00F6
BaBc, xrefs: 00BB0197

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: BaBc$Ye[g
API String ID: 0-286865133
Opcode ID: 20a00836de8f27b93084267ce082bf7f3661bb29362c2b1820b8ec99fcb00f63
Instruction ID: d35a4fa103badf2126c99c936d34f8a87a98d349b835c5de33242a3a9f46508a
Opcode Fuzzy Hash: 20a00836de8f27b93084267ce082bf7f3661bb29362c2b1820b8ec99fcb00f63
Instruction Fuzzy Hash: D651CCB16183858BC731EF18C881BBBB7E0FF96310F08495DE49A9B651E3B49940CB57

Function 00B95160 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 00B954C8

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 68eb9a0506cef4954dac51bbcd63575a669911dcda81232007bcc746a268b8d2
Instruction ID: 79cf089e69deef8bfbd757061e7dafb37f63d8d0f95b184294476287f4d0b016
Opcode Fuzzy Hash: 68eb9a0506cef4954dac51bbcd63575a669911dcda81232007bcc746a268b8d2
Instruction Fuzzy Hash: 3122D2B2A48B428BEF368E58D880326BBE2EFE0304F1985BDD8994B351E775DD45C741

Function 00BC12D0 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 00BC15D1

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction ID: 5711ac524edc17d3f05575b5233780fe408f597f40d411a1644844be48c26d9e
Opcode Fuzzy Hash: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction Fuzzy Hash: D7F1F571A083415BC724CE28C491F6BBBE5EFC6354F188DADE89AA7383D634DD058792

Function 00BBAE57 Relevance: 1.7, Strings: 1, Instructions: 455COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00BBB2D3, 00BBB2DB

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: da555a5b813143ffed9717bc8372c13218b4028e913995b9a6ede9f724b5b495
Instruction ID: a75e29149558cb61356c4180e9e5969d6c2ad593857f676e3d0ca94a776c461f
Opcode Fuzzy Hash: da555a5b813143ffed9717bc8372c13218b4028e913995b9a6ede9f724b5b495
Instruction Fuzzy Hash: D1E19A71508346CBC324DF28C4909BEB7E2FF98781F64895CE4C587221E7B1E999CB92

Function 00BA6EBF Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00BA6EF3

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: d38cafeda1f412bfc29a7cc95f3d8bc30397e7e619c2417d2d8b7e76891a6949
Instruction ID: 0291738b865b7792c38e8fb5d12eb98e7d3bb6c4919dde005af1027c45014f7f
Opcode Fuzzy Hash: d38cafeda1f412bfc29a7cc95f3d8bc30397e7e619c2417d2d8b7e76891a6949
Instruction Fuzzy Hash: FCF1ADB5A04A01CFC724DF24D891A26B7F2FF49314B188ABDE49787A91EB31F815CB45

Function 00BB7E60 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00BB8263, 00BB826B

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: ed7bdcb999b7a05afa63129abb0fc9486ce7982c1207fc5f282197a8542aac92
Instruction ID: 1e19026452b811d8b7a0318975267215d4f752e57bdfa54f5601a3679887c272
Opcode Fuzzy Hash: ed7bdcb999b7a05afa63129abb0fc9486ce7982c1207fc5f282197a8542aac92
Instruction Fuzzy Hash: ADC1DF71509200ABD710EF18D882A7BB7F9EF95754F48889CF8C59B251E7B4EC11CBA2

Function 00BB8D62 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00BB9233, 00BB923B

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: f44e71146079a395ec3e9a39ba7f9c3ed144cd48b429689d4a2c0cfa8e1e6f8b
Instruction ID: 6c45535e2bb2394bc995e5b76bbfd363b1bb70d978097cd637c9c8c720287c8a
Opcode Fuzzy Hash: f44e71146079a395ec3e9a39ba7f9c3ed144cd48b429689d4a2c0cfa8e1e6f8b
Instruction Fuzzy Hash: 10D1D070628342DFD704EF68DC90A6AB7E5FF89305F4988BCE9868B251DB74E850CB51

Function 00BD7FC0 Relevance: 1.6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

P, xrefs: 00BD8167

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 2eefbf977feb1e87c54c33996dad57d1f240410fa3d5e8ee41a53c826957b417
Instruction ID: 877c9da5c7ee67e46f1258daa705f4e7f89bc27f81173c15ff9849bf3c541467
Opcode Fuzzy Hash: 2eefbf977feb1e87c54c33996dad57d1f240410fa3d5e8ee41a53c826957b417
Instruction Fuzzy Hash: 61D1D4729082658FC725CE18E89071EF7E1EB85718F19866DE8A5AF380EB71DC46C7C1

Function 00BBCCD0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00BBCDC3, 00BBCDCB

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+(
API String ID: 2994545307-3233224373
Opcode ID: 0d964e0d1910e5c4a2c662d94d98aa0a9274dce88d1c6dc71946e61bd4803ee7
Instruction ID: 9ec55a7d8dd76ba9f17039443a9400cd9ec2584bcf85a96da7747a2e911da023
Opcode Fuzzy Hash: 0d964e0d1910e5c4a2c662d94d98aa0a9274dce88d1c6dc71946e61bd4803ee7
Instruction Fuzzy Hash: 03B1F070A083019BD714EF18D890BBBBBE2EF85340F5449ACE5C58B352E3B5E855CB92

Function 00B9A850 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

,, xrefs: 00B9A9C3

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction ID: 947ba978d6d1a0af29b36bbec354115cdda26df6e4c9ab21b06477c05d034568
Opcode Fuzzy Hash: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction Fuzzy Hash: 03B138702083819FD724CF18C88061BFBE1AFA9704F448A6DF5D997342D671EA18CBA7

Function 00BCFC20 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00BCFCA4, 00BCFCAD

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: d8db152152b98df15b4b7f557ef153e6a7b386ada1db25eb6acc99acc20e1155
Instruction ID: 482445d68cf85695a8564f0395bd50e9e97d388d779ce8228223a09c90c4ab3f
Opcode Fuzzy Hash: d8db152152b98df15b4b7f557ef153e6a7b386ada1db25eb6acc99acc20e1155
Instruction Fuzzy Hash: D481CEB0608342EBD710DF54D884F2AB7E6FB99705F0488ACF5C58B252E730D814CBA2

Function 00BAD457 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00BAD663, 00BAD66B

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: ab429020faa7b660404ba43dc6b9c073c4fe8379cafffce86e8315ae65e7bd0a
Instruction ID: a51f0257ccc8ef3c03ebd4aa53b7a9c8e90a5c6aaf24d6af680f6552281cec17
Opcode Fuzzy Hash: ab429020faa7b660404ba43dc6b9c073c4fe8379cafffce86e8315ae65e7bd0a
Instruction Fuzzy Hash: 1C61E3B1908204DBD710EF58DC82A2AB3F1FFA5354F4809ADF98A9B351E771D910C792

Function 00BD4A40 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00BD4C33, 00BD4C3B

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 85fd36d2a8c6297703e0bfd536c419558e435d6946f18a95fc3c8683b06baef7
Instruction ID: 513f5a1461994bc464c50cc6999c23551f1214d17b7710ca040ea95a86c509a0
Opcode Fuzzy Hash: 85fd36d2a8c6297703e0bfd536c419558e435d6946f18a95fc3c8683b06baef7
Instruction Fuzzy Hash: 1461E0756083419BD724DF25C880B2AF7E6EBD4314F2889AEE5C58B391E771EC50CB52

Function 00DCF2C9 Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

;Y-N, xrefs: 00DCF507

Memory Dump Source

Source File: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: ;Y-N
API String ID: 0-3561849851
Opcode ID: a402fb986f710115da462a81ed3fc65f9fbe64ae0688b1a37188942632a6ad25
Instruction ID: 6ccf444d0baf91f6852cea4d182a7c3b722358c89b029bb1bb476ca5a5ac8b3f
Opcode Fuzzy Hash: a402fb986f710115da462a81ed3fc65f9fbe64ae0688b1a37188942632a6ad25
Instruction Fuzzy Hash: F45135F660C304AFE304AF29EC4567AF7E6EBD4720F11C63EE6C483B44EA355805865A

Function 00B9E1A0 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 00B9E333

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: 0738bb5b0cab84619f1295ee0341b7dc21610caa18943ab2644a95f66d11859a
Instruction ID: 4046a3afbabf384678a7b60adcf9b97bf6e7dd5c0c0a6fcb7ad51b8c87c3d7d9
Opcode Fuzzy Hash: 0738bb5b0cab84619f1295ee0341b7dc21610caa18943ab2644a95f66d11859a
Instruction Fuzzy Hash: 59512723A5D6914BD725CA3C9CA1269BAC70BA3334B3D87BAE9F58B3E1E515C8048350

Function 00BD3920 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00BD39E3, 00BD39EB

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: d217097e3b45520179e6fce7fa64b984fdfbed934705f7e510704a8524911711
Instruction ID: 1f906864ca63c21727439e41546a90e579ca2a9ba57ae95c8f578977019b5307
Opcode Fuzzy Hash: d217097e3b45520179e6fce7fa64b984fdfbed934705f7e510704a8524911711
Instruction Fuzzy Hash: 5651BF746092409BCB24DF14D990A2EF7E5EF85B04F18889EE4C687352E776DD10CB63

Function 00BA1BEE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 00BA1C3E

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: a00bedaf484006816bbcf8814347bad13ed9fc09bc1c9e6cfc7be5f5898fed26
Instruction ID: 31adaf0ad5969bd16c97b1a886ddde469d36b86fc042a58d92825dedd3432f85
Opcode Fuzzy Hash: a00bedaf484006816bbcf8814347bad13ed9fc09bc1c9e6cfc7be5f5898fed26
Instruction Fuzzy Hash: C54132B800C3809BC7549F18D894A2BBBF4FF86724F049D5CF5C59B291E736C9158B56

Function 00BCFF70 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00BD0033, 00BD003B

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 7235ac1cd12f2eb5b937e0978710d8fd062782d737df79d7ad17d165be70bbfd
Instruction ID: 4e915f925c256a2779b868cbee43aa45def047f5f8418188b2bd69447644b16b
Opcode Fuzzy Hash: 7235ac1cd12f2eb5b937e0978710d8fd062782d737df79d7ad17d165be70bbfd
Instruction Fuzzy Hash: EE31E5B5518309BBDA10FA14EC81B2BF7E9EB85744F5448AAF88487352F231DC14C763

Function 00BBE40C Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

72?1, xrefs: 00BBE6A2

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: e2c0a800561eea67e9446586ee938be09ac78d0fb2a221f31364146182192063
Instruction ID: f622deda56d675a1bb886e22484022b86e7d10ed46bc62766566d9798fbc1210
Opcode Fuzzy Hash: e2c0a800561eea67e9446586ee938be09ac78d0fb2a221f31364146182192063
Instruction Fuzzy Hash: 1A31A275900244CFCB20CF99E8C05AEBBF5EB06304F6408A8E45AAB212C771ED05CBA1

Function 00BA6F91 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00BA703B

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: df8988aa0a58064605accf595b9efd059874698d0bd27b187d40d18a3af0cdc9
Instruction ID: 3a35b7f2f63ae6f0f286301ca548df1b34ce5703ed23ecb42c1ee051b7671a8e
Opcode Fuzzy Hash: df8988aa0a58064605accf595b9efd059874698d0bd27b187d40d18a3af0cdc9
Instruction Fuzzy Hash: 05415675209B04DBD7348F61CD90F26B7F2FB4A705F14889CE5C69BAA1EB32E8108B10

Function 00BBE66A Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

72?1, xrefs: 00BBE6A2

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 34cc97a56f5243867d3a4b39213a72c93bbe8323935560fa41a71aa4c793939a
Instruction ID: 900a5b4fdcc9001940b965511abca3b5b030c5414ea882e4b4ae189e663ddfb4
Opcode Fuzzy Hash: 34cc97a56f5243867d3a4b39213a72c93bbe8323935560fa41a71aa4c793939a
Instruction Fuzzy Hash: 58218075900244CFCB208F99D9C05BFBBF5FB1A744F640898E456AB252C775ED01CBA1

Function 00BD9CE0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 00BD9D30

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: bfdf61f4e2e8e0053d823faba1e6bbc6a81db112c7d7b4195f94fec10ae42049
Instruction ID: 8e2226400849730ce07560fa4354fd1ea2d9c4e3075950da80f13fc34840c922
Opcode Fuzzy Hash: bfdf61f4e2e8e0053d823faba1e6bbc6a81db112c7d7b4195f94fec10ae42049
Instruction Fuzzy Hash: 473178745083409BD310DF14D880A2AFBFAEF9A318F14896DE5C897351E335D904CBA6

Function 00BA4E2A Relevance: 1.0, Instructions: 957COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f6d6318514bfe49573eb2d06ba5714446705f6fa7e55fb8420008738260139b
Instruction ID: b0100ba23f7a03d310ff580951efcd279405d5cd356318fa26c78e640187c8cc
Opcode Fuzzy Hash: 7f6d6318514bfe49573eb2d06ba5714446705f6fa7e55fb8420008738260139b
Instruction Fuzzy Hash: 206247B0904B008FDB35CF24D990B26B7F6AF5A704F5489ADD49B87A52E734F908CB94

Function 00B9BEB0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction ID: 3e9327eeb05e00143b14066197281abd2aac11b0fc8619f2e4968dbae95811f1
Opcode Fuzzy Hash: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction Fuzzy Hash: 6B523931A087118BCB25DF18D8802BAF7E1FFD5319F698A7DC9C693291D734A851CB86

Function 00BD8652 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 418b2eae5107784324a28b62e132957ee874ffa0f0d77fd8a9047d10d321cfe9
Instruction ID: 6773e79902cb99fe9ce88d675d1d20661a45e6fc0df8bf9ef3a905bc7084af7b
Opcode Fuzzy Hash: 418b2eae5107784324a28b62e132957ee874ffa0f0d77fd8a9047d10d321cfe9
Instruction Fuzzy Hash: 2C22AA35618381CFC704DF68E89062AFBE1FF8A315F0989AEE5898B351DB35D950CB42

Function 00BD86F0 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63b8ce2e06b8ff846495a51670dad6e2c8d192c64c06780f641d2abf45aa9a6d
Instruction ID: ac028feb0f896253ccbdf0b6659fbf8bcb6aa9eeda9320a782fc08067f76c4d7
Opcode Fuzzy Hash: 63b8ce2e06b8ff846495a51670dad6e2c8d192c64c06780f641d2abf45aa9a6d
Instruction Fuzzy Hash: B2228935618380DFD704DF68E89062AFBE1FF8A315F0989AEE5899B351DB35D850CB42

Function 00B9B3A0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfd8865a6d74b657699e8c1d310f3c259436f9322a6e2ca77fc5ca562f55d337
Instruction ID: c1f83abace5be4db0ca1155f47a4f119902979aba4a94a797863fbf6e5a6cce8
Opcode Fuzzy Hash: dfd8865a6d74b657699e8c1d310f3c259436f9322a6e2ca77fc5ca562f55d337
Instruction Fuzzy Hash: 2B52A170908B888FEF35CB24D584BA7BBE2EF91314F144DBDC5E606A82C779A885C751

Function 00B971F0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c480c0de7ede983fc8a11747c5578ea04a3c026c43d62fa8487316226bf1ef85
Instruction ID: 034f28142646f9fb3e6ef9c915e6c2763fb9d6a4ce776d373997a807b932f0c5
Opcode Fuzzy Hash: c480c0de7ede983fc8a11747c5578ea04a3c026c43d62fa8487316226bf1ef85
Instruction Fuzzy Hash: 9452BE3151C3458FCB15CF29C0906AABBE1FF89314F198ABDE8995B352DB34E949CB81

Function 00B98FD0 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97035f98202d9d67044f268a0cb653961efb28196530884b7de61b21b937a421
Instruction ID: e46058d4004b4364dfdaea882b57fb6ee7e6e5bdb7770d2cc2fd3e1f46c79c6c
Opcode Fuzzy Hash: 97035f98202d9d67044f268a0cb653961efb28196530884b7de61b21b937a421
Instruction Fuzzy Hash: 75425575609301DFDB48CF28D8A076ABBE1BF88315F09886DE4958B391EB35D945CF42

Function 00B97BF0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba7fbc3393b89bee23f6a6c01215af481d99bc08da71962d09b1c98e33ff7030
Instruction ID: b1dc1780bba9a3ee723a6567fd16c89b48916e6778092512f38cdd4ca06d5c50
Opcode Fuzzy Hash: ba7fbc3393b89bee23f6a6c01215af481d99bc08da71962d09b1c98e33ff7030
Instruction Fuzzy Hash: EC320270528B118FCB68CF29C59052ABBF1FF46710B604AAED69787B90DB36F845CB14

Function 00D644B4 Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcc2a71e247353f4f8c402438ee0e9627538936a868f316ca9870f7d2ded6c33
Instruction ID: 2872f9369bd1bb32a37071e4d1bd3cf38c8d3558b3e30c1acc3358cb35bbbdd8
Opcode Fuzzy Hash: dcc2a71e247353f4f8c402438ee0e9627538936a868f316ca9870f7d2ded6c33
Instruction Fuzzy Hash: D602F5F360C3049FE3056E2DEC8567ABBEAEFD4720F1A453DE6C483744EA3598058696

Function 00BD89A0 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2214c3d438e123cfab63194c0b3a3f9228519f8d96de8031e189ba4aa7eef709
Instruction ID: 082f03e85e109a6980dab72f4f45be288dc6d7de448d23e1624cf766357f70d0
Opcode Fuzzy Hash: 2214c3d438e123cfab63194c0b3a3f9228519f8d96de8031e189ba4aa7eef709
Instruction Fuzzy Hash: 2D029A35608281DFC704DF68E88061AFBF1EF8A315F0989AEE5C98B361D735D954CB92

Function 00BD8A80 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87d0204309a272ae0fa788bffe56abf75fe031e41817ffee12096c5e231cd998
Instruction ID: 84bf731ea1cb8dc814bd6b94e995405df2ce8ff590a781d23eea6217cb7c102e
Opcode Fuzzy Hash: 87d0204309a272ae0fa788bffe56abf75fe031e41817ffee12096c5e231cd998
Instruction Fuzzy Hash: 40F17935618380DFC705DF68E88061AFBE1EB8A305F09896EE5C98B351D736D914CB96

Function 00BD8C02 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0c85266f28e51aa41e091d109892d530c975a08234b9ec3d69de5bef1100a98
Instruction ID: b57882aefaa709d906ea25dba39a8974056d7868c7391718945b4831229b3630
Opcode Fuzzy Hash: e0c85266f28e51aa41e091d109892d530c975a08234b9ec3d69de5bef1100a98
Instruction Fuzzy Hash: 31E19E35A18381CFC704DF28E88062AF7F5EB8A315F09896DE5D98B351D736D914CB92

Function 00B9A300 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction ID: b0cf43315d10c5a619931fff77a1ff71f51c013aacee51c4597f89ce2a9f63c3
Opcode Fuzzy Hash: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction Fuzzy Hash: 5FF1BD766083418FCB24CF29C88166BFBE6EFD8300F48886DE4D587751E639E945CB96

Function 00BD8E70 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bb9651673874b429850d4b30300d19828d1e2755115c2e85d0bddf454d10819
Instruction ID: 13c048dbc3710ad947b231aaf8464a4eda59b87a7b7f6a8bd52a8c71351ec989
Opcode Fuzzy Hash: 1bb9651673874b429850d4b30300d19828d1e2755115c2e85d0bddf454d10819
Instruction Fuzzy Hash: D8D17A3461C280DFD705EF28E89062AFBF5EB8A305F0989ADE5C58B351D736D814CB92

Function 00BA4487 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e251a101113cad786067f81194fb821e9b0b435bdc40c99316debcf044601bc8
Instruction ID: f62e39fbb8d84b0dd9598b296a8719150db9cade995eac504868dcd57a5adbc7
Opcode Fuzzy Hash: e251a101113cad786067f81194fb821e9b0b435bdc40c99316debcf044601bc8
Instruction Fuzzy Hash: 67E101B5505B008FD321CF28D9A2BA7BBE1FF46704F04886DE4AA87752EB75B8148B54

Function 00BD6CBF Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a80201c2d762b91dd8d7edeb3ca63e3fd293ff8e85957f10a5bc5551be7f46a
Instruction ID: 51b9e0268de1776b1c054195b19afdb673db965029c4437bda8e03a9151b183a
Opcode Fuzzy Hash: 5a80201c2d762b91dd8d7edeb3ca63e3fd293ff8e85957f10a5bc5551be7f46a
Instruction Fuzzy Hash: CDD1C036618795CFC724CF38D8C052ABBE2EB89314F198AADD495CB391D734DA44CB91

Function 00BD7AB0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10bfba03a498607fc7181b6eace343274041d69af6783253cb5e071c73b7eac9
Instruction ID: e4959e73a79fe174be2d98b4d8e9ad2e52770f4f22cf26a222477c88c226bb8e
Opcode Fuzzy Hash: 10bfba03a498607fc7181b6eace343274041d69af6783253cb5e071c73b7eac9
Instruction Fuzzy Hash: D0B10572A483504BE724DA28DC417ABF7E9EBC4314F4849BEE99997381FB35DC048792

Function 00B9AF10 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction ID: 6ef6a74bb63608748b1a41c0844bff8542c3d8f9ac0ae39fd4abc5f6c0936897
Opcode Fuzzy Hash: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction Fuzzy Hash: EBC18DB2A187418FC760CF68DC96BABB7E1FF85318F08492DD1D9C6242E778A155CB06

Function 00BA6536 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cc2cbe323f031292b0c276963aee36016929fa464ef6ff74ae1c105e404ba3b
Instruction ID: 05afc93fef1e35f6d6e5a5a816467fb50f49699875cebbec04ef68fc42a09ff8
Opcode Fuzzy Hash: 7cc2cbe323f031292b0c276963aee36016929fa464ef6ff74ae1c105e404ba3b
Instruction Fuzzy Hash: 1EB111B4504B408BC325CF24C981B67BBF1EF5A704F18889DE8AA8BB52E735F805CB55

Function 00BD7710 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0405c9628c142542075484ca8b3dacfc7b749ae57daeb2f2511d6cb2da574da1
Instruction ID: ec58bdedbb8fa5ebfe79de0ba96c5e4fe3a13bf4a4de545bb7028a4e3e9f76d7
Opcode Fuzzy Hash: 0405c9628c142542075484ca8b3dacfc7b749ae57daeb2f2511d6cb2da574da1
Instruction Fuzzy Hash: 20919D75A48341ABE720CB15D880BAFF7E5EB85354F94885EF58887351FB30E950CB92

Function 00BDA0D0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27644f67991309f16c48777cf0fda820e25356706b996b8dcfa0595998e3f9c9
Instruction ID: ce325ef71a23731532e615ea42ee9adea757308066b6629f0d9a692cf724c41d
Opcode Fuzzy Hash: 27644f67991309f16c48777cf0fda820e25356706b996b8dcfa0595998e3f9c9
Instruction Fuzzy Hash: A181AB342087028BD724DF29C890A2AF7F5EF89754F5589AEE5868B351F731EC10CB92

Function 00BC64F0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af6bd38a8ec8602fc1241b20f98504b85af1bc3daa5a788ffe36f64c3363a31c
Instruction ID: d697963cbc195deface4152ee75463d0563a0566e29b36daad4d9abe6c05ef21
Opcode Fuzzy Hash: af6bd38a8ec8602fc1241b20f98504b85af1bc3daa5a788ffe36f64c3363a31c
Instruction Fuzzy Hash: EC71C633B69A904BC3149D7C5C92BA5AB834BE6334B3D83BEE9B4CB3E5D5294C064350

Function 00BB28E9 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1c05b31642a3c167c5af1e564b8f99edc0ab9ffb2cba11dea299ea828f1e231
Instruction ID: 80dacd1f2740669423a4e0087707eb05d7dbf75b2d1fbe7f4792bc0a23c4dce8
Opcode Fuzzy Hash: b1c05b31642a3c167c5af1e564b8f99edc0ab9ffb2cba11dea299ea828f1e231
Instruction Fuzzy Hash: 516179B44183409BD710AF19D881A6BBBF1FFA6750F04499CF4C58B261E3B9D910CB6B

Function 00BB7C00 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 736ebd0ecaf99f890c22d3e90e305e32e6eac2d1cc9139f24a46018cd9c0e358
Instruction ID: 84c74acf6b9b36172cc341f19bfdca9b7709f95b3d345106e5d3622f0513953b
Opcode Fuzzy Hash: 736ebd0ecaf99f890c22d3e90e305e32e6eac2d1cc9139f24a46018cd9c0e358
Instruction Fuzzy Hash: 9551B0B16482049BDB209B24CC92BB777F4EF85354F1489A8F9858B391FBB5DC01C761

Function 00C9A298 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55251e67cec009ef811cfbd6c90bb5b9d4a832c1c24c743444d406345b4e0291
Instruction ID: 0bbbc448b4e82f665b235c2c6e9e0e36cbabb2514b294bf36fb63c11ba99fa41
Opcode Fuzzy Hash: 55251e67cec009ef811cfbd6c90bb5b9d4a832c1c24c743444d406345b4e0291
Instruction Fuzzy Hash: CB513DB3A482105BF3106E2DED8576677DADBC4334F2A863DE684C3784E97A98068295

Function 00BC1860 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction ID: 401c20cb53dd7d203269c84072b74e88611fa4ae6eb1c8b156745e3cefdf28ce
Opcode Fuzzy Hash: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction Fuzzy Hash: A261AF3160D3119BD714CE2DC580B2EBBE2EBC6350F64CDADF4A9AB252D2B0DD469741

Function 00BC82D0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98f4800d6ff0d28d91a7327a8919f70e1e8db570290c66421394f48db3f64cf8
Instruction ID: 79bb813fc94333d73fb0afb8766e91c6ed384ca230b2e07b0a69f3dcdc29279c
Opcode Fuzzy Hash: 98f4800d6ff0d28d91a7327a8919f70e1e8db570290c66421394f48db3f64cf8
Instruction Fuzzy Hash: 21613A33A5A9914BC319453C5C957A6AAC35BE2330F3DC3EEE8F58B3E5DD6948018341

Function 00BA42FC Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c847b4aa21f04b325f93d4193e84fb021782f6f6ee2c30487bd2d281f0b7b70
Instruction ID: eef5c0418932999286880b7920712f8c3552b38c90ef4a086d5c1ac7abbcb7ac
Opcode Fuzzy Hash: 5c847b4aa21f04b325f93d4193e84fb021782f6f6ee2c30487bd2d281f0b7b70
Instruction Fuzzy Hash: 3981E0B4814B00AFD360EF39D947757BEF4AB06301F404A6DE4EA97695E730A419CBE2

Function 00BCE8A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction ID: 399fd4315ed163261fbde1f9f2f8ebd1e1c168d0656c8b1a7bc876115a4b44bf
Opcode Fuzzy Hash: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction Fuzzy Hash: 23515BB16087548FE314DF69D49475BBBE1BB89318F044E2DE4E987350E379DA088F92

Function 00C3E201 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eb896efdd4be2137f914dc96966e9544bc4775cb992f9ec83f841d6711df564
Instruction ID: e2b2119702f5fd00d8f1d6071fbae3101252b5f4f57aad956c7ab74cfa5c3dda
Opcode Fuzzy Hash: 3eb896efdd4be2137f914dc96966e9544bc4775cb992f9ec83f841d6711df564
Instruction Fuzzy Hash: 3D5169F7A082005BF3046928EC057BAB6DADBD4320F1A823DEB84D7788F939D90546C2

Function 00BD7520 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fb6773d63a73fa8518042d2437e671d7114d2e24248ee9ceb58c597b007f29d
Instruction ID: 69e6ab6841734a29394e9bab87a85a86b2602184eba079a562dfdda6bbf0012d
Opcode Fuzzy Hash: 4fb6773d63a73fa8518042d2437e671d7114d2e24248ee9ceb58c597b007f29d
Instruction Fuzzy Hash: 7851273164C210ABC7149E18DC90B6EF7E6FB85318F288A6DE9D55B391FB31EC108B91

Function 00B95A50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16f26807757e10cc80eb46447801ce1315c8cfd81351b0817c0c0abfe8c881b8
Instruction ID: 2098383665dea20da4a817e158646c9b7d4dd25a72a4000a57fac2fa71968866
Opcode Fuzzy Hash: 16f26807757e10cc80eb46447801ce1315c8cfd81351b0817c0c0abfe8c881b8
Instruction Fuzzy Hash: 4151C1B5A047049FCB25DF18C890926BBE1FF89324F5546BCE8998B352D631EC42CB92

Function 00D372DB Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36f64fa386b9dfd1e2194f4166a5bcbe770e7cc2c42f5555b8ec1f050990741d
Instruction ID: 0de4bdcf9705b033f09c2f301c4c48c2b56890ca621affc2c26b0175e9a5998a
Opcode Fuzzy Hash: 36f64fa386b9dfd1e2194f4166a5bcbe770e7cc2c42f5555b8ec1f050990741d
Instruction Fuzzy Hash: 3E5126F3D082109FE304AE28EC8676A77D5EF94720F1A453DEFC893384E9395C058686

Function 00CA38EA Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 372ecc3b0defa891c9f32e235e7a2ab780c632d8a974d40e69a21955d6d374d5
Instruction ID: 4ba752b6a2d4f57723e87dd718f19385fff66b60e75cd1cae7c59e897f00a3b5
Opcode Fuzzy Hash: 372ecc3b0defa891c9f32e235e7a2ab780c632d8a974d40e69a21955d6d374d5
Instruction Fuzzy Hash: 5341D6F3A082049FF3086E29EC95776B7E9EB54314F16053DEAC583380E5366D058686

Function 00DCF688 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60add087be4c5e33784aff452b1c0db79608655b58ec4c3723d44f03340751b9
Instruction ID: 4064aa2013723a5837d9e04197562b96fd46823e5d445853981721e9db97772d
Opcode Fuzzy Hash: 60add087be4c5e33784aff452b1c0db79608655b58ec4c3723d44f03340751b9
Instruction Fuzzy Hash: 564106F290C2009FE701AF29DCC166EBBE6FFD8320F1A893DAAC597744E63558158643

Function 00BBEC48 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0217ed15daeefdd13a0f514373478ce703d954e0fd24a3990b88d7d53e5c113
Instruction ID: 6c1a18e54ddab3b0d3dd5e8f7be80e46d0b959c43f03451017b29239bb5d0dbf
Opcode Fuzzy Hash: a0217ed15daeefdd13a0f514373478ce703d954e0fd24a3990b88d7d53e5c113
Instruction Fuzzy Hash: 18418C78900315DBDF208F58D891BF9B7B0FF0A340F144598E955AB3A1EB78A951CB91

Function 00D4246F Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64dc42c5b0ab8772a43d756fed9291872ff5f76b99f4313104d700a43f9906e3
Instruction ID: c571f10361f5bcbb9ee1c4c6bc5497492f0143bb802eac72b526d4cd46b20e41
Opcode Fuzzy Hash: 64dc42c5b0ab8772a43d756fed9291872ff5f76b99f4313104d700a43f9906e3
Instruction Fuzzy Hash: 2D4105F3A082106FF344AA29EC857BAB7DADFD4720F1AC53EE6C483744D63958058692

Function 00BD9B60 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c488dd33e8fbb11995f9add815f46f535b0c11122568a5b36fac13d582d535a4
Instruction ID: 7c49200c11a98949936d1ad0f390ea882eb4497a64f9ff9353861b0083eb10e6
Opcode Fuzzy Hash: c488dd33e8fbb11995f9add815f46f535b0c11122568a5b36fac13d582d535a4
Instruction Fuzzy Hash: CB419E74218340ABD720DF14D990B2AF7E6EB85714F1888AEF5C99B351E331EC10CB62

Function 00BA2030 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20cc685370adf2de73103e96a5d9b3ff2f3bcb4e013e965f7e500c6377309adf
Instruction ID: e3342fe090204af747d7d73916e0294290a388665994bc09a9164c8d7131bd35
Opcode Fuzzy Hash: 20cc685370adf2de73103e96a5d9b3ff2f3bcb4e013e965f7e500c6377309adf
Instruction Fuzzy Hash: 4241D672A0C3654FD75CCF29C49023ABBE2ABC5300F19866EE4D6873D4DA748945D781

Function 00BA1E93 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 852d5a4cc655512751e715b528ce9adaa19d5c69dd0e42e1f47ce06565d2ebfc
Instruction ID: 694f238f6724457d957f53ca6806ad745bd540362169ad8310abd857011844bc
Opcode Fuzzy Hash: 852d5a4cc655512751e715b528ce9adaa19d5c69dd0e42e1f47ce06565d2ebfc
Instruction Fuzzy Hash: B041DC7450C380ABD320AB58C884A2EFBF5FB86354F144D5DF6C497292C376E8148B6A

Function 00BD8D8A Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a47290d0e0dd7133d716484af13fc9467c76aa17c0c2db394aaa9444151d17fd
Instruction ID: 123e656341096cd92b6a8b869585c31a8468dd2f12b1086241abaf3b41890181
Opcode Fuzzy Hash: a47290d0e0dd7133d716484af13fc9467c76aa17c0c2db394aaa9444151d17fd
Instruction Fuzzy Hash: 9041A0316082548FC704DF68C49052EFBE6EF99301F198A6ED4D9973A1EB75DD018B82

Function 00BAD961 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de02f80b4dae5b60388ad5b96976aa0058a769112edcfcc33483255cf6e11bb2
Instruction ID: ac5538c739f745e5a8563b7fa20ac8e684bc7cf3d7618263b7efae6f77e053a0
Opcode Fuzzy Hash: de02f80b4dae5b60388ad5b96976aa0058a769112edcfcc33483255cf6e11bb2
Instruction Fuzzy Hash: 3B41AEB16083818BD7309F14C881BAFB7F0FF96360F040999E58A8BB91E7748940CB57

Function 00BCF030 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction ID: 4fdad7fa309852586f0a7227824fcbd2d41ae31394decc008e9499cf8283db76
Opcode Fuzzy Hash: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction Fuzzy Hash: D02107329082254BC3249F59C481A3BF7E6EB99B05F0686BED9C4A7295E3359C1487E2

Function 00BD67EF Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee3a5fd27d1a6aa8703e7d7e0ce124d38832c0d47e487eb03beab567c4b749af
Instruction ID: 93fce9e40d215efb1bdd08fc1b9539e1476a850508fdefbcc1de407f6864f861
Opcode Fuzzy Hash: ee3a5fd27d1a6aa8703e7d7e0ce124d38832c0d47e487eb03beab567c4b749af
Instruction Fuzzy Hash: 993134705183829AD714CF14C4A062FFBF0EF96784F50584EF4C8AB262E739D985CB9A

Function 00BB5E70 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f66ca34ebb2079d0d15a2bdf692421591a8bd7b5cc8f78a77493f51220c08205
Instruction ID: 2c5703d2a5c35f1130023d266caf82b443c63ddd67c803f51a3c69c687f36990
Opcode Fuzzy Hash: f66ca34ebb2079d0d15a2bdf692421591a8bd7b5cc8f78a77493f51220c08205
Instruction Fuzzy Hash: AB21B2705086019BC321AF18C841ABBF7F4EF92764F44895CF4D59B292E374D900CBA3

Function 00B949A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction ID: cd50a36f8d221a5a245004eaec54ea7ced54f85a3ec7943ffbdf384bbd728e7c
Opcode Fuzzy Hash: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction Fuzzy Hash: C531C5316582009FDB149E58D880E2BB7E1EF8A359F1889BDE89A9B251D331DC53CB46

Function 00BD64B8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94e146d9510df87fe14ad3e7ca436616bf561634af1a2056802870b744e4a079
Instruction ID: f55f267c69589aa325dc29c3458d6e61436d614eec251c9e2a801b536c070b7d
Opcode Fuzzy Hash: 94e146d9510df87fe14ad3e7ca436616bf561634af1a2056802870b744e4a079
Instruction Fuzzy Hash: 4E21957460C2409BC704EF19D480A2EFBE2FB95758F28885DE4C487362E734AC60CF62

Function 00BD5700 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf67bcf35caa6f93cf5dee7c1d2c1973a377fa7fa51f0b8f8fa5c61966793b74
Instruction ID: 44f067cfc38504a418fe38b70de6b54d9e1e984a329ad0811a5ac05f7bd1af0e
Opcode Fuzzy Hash: cf67bcf35caa6f93cf5dee7c1d2c1973a377fa7fa51f0b8f8fa5c61966793b74
Instruction Fuzzy Hash: CD11A07591C280EBC311AF28E884A1BFBF5EF86B11F158869E4C49B311E735D811CB93

Function 00BCB650 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 07f856953508b88ece0568493d495b3cf1aed652888ee832201b321784cdfe46
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 6911A332A051D40AC3168D3CC440E69BFE25AA3234F5943EDE4F49B2D2D7228D8A9354

Function 00BC0B80 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction ID: 3fc2d59ff9e486c548b0de9a39b01c6c8e3a1159c7cc75ad04cd5d9961bd423b
Opcode Fuzzy Hash: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction Fuzzy Hash: D501B1F5A2030287EB20FE1094D0F3BB2E9AF94718F0945BCE81A47202DB72EC04C2A5

Function 00BBD1E1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa1573318baff7ecb17bfd1368df537895ad3bd06efed9aa2eb6458ddf7ac8b4
Instruction ID: afc92b22bf4c7babd6d9025c17658d22d09984d5bc535b9cf37ede2498231f1f
Opcode Fuzzy Hash: aa1573318baff7ecb17bfd1368df537895ad3bd06efed9aa2eb6458ddf7ac8b4
Instruction Fuzzy Hash: D111ECB0418380AFD310AF61C484A2FFBE5EBA6714F248C5DF6A49B251D379E819CF56

Function 00B96EA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a583a33e601d1cb1b041b9d96d0c48f08dcc63f93168a8b423190dd8e4011014
Instruction ID: 62dae657f6e8c4e5777450b8828c7bcca3669b65c714c228b36b760fbae0060b
Opcode Fuzzy Hash: a583a33e601d1cb1b041b9d96d0c48f08dcc63f93168a8b423190dd8e4011014
Instruction Fuzzy Hash: EDF0593EB2920A0BA610CDAAE8C0D3BF3D6D7CA354B09153DEE40D3201DD72E80681D0

Function 00BCB8C0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction ID: 6506d07c58c905065930edc77b6421f51c28c54387ea28b09faa2761b04cb969
Opcode Fuzzy Hash: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction Fuzzy Hash: 1E0162B3A199610B8348CE3DDC1156BBAD15BD5770F19872DBEF5CB3E0D230C8118695

Function 00BAC5F0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 00BAB410 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: cba5ad65947102a7883dc14ace46b92577f030036c3dc59a592ebaeafde44094
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: 52F0A0B1A086106BDB228A589C80F37BBDCCB8B364F1905A6E88597203D661AC45C3E6

Function 00BC8220 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f64abdc97a97d8cfde01da22cc8b4d2aec4eb6417c3a83d93abde2d331a5f805
Instruction ID: 77e058e7540250c0d4f7bec9b8cd2ae630d4d278433acacb9f0ebd5ede88a45c
Opcode Fuzzy Hash: f64abdc97a97d8cfde01da22cc8b4d2aec4eb6417c3a83d93abde2d331a5f805
Instruction Fuzzy Hash: 7701D2B04107019FC360EF29C445746BBE8EB09714F004A5DE8AACB790E770A544CB82

Function 00BD1440 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 7fbc117c15797ed86ed673d15231a30d3ba0aec23f7674e0b826500e487b4dc5
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: A3D05E2160832156AB648E1DA4009B7F7E0EA87B11B49999FF586E3348E230DC41CAA9

Function 00BA1ACD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87057a8b95e8a5c78d102d4e606d6db87f0e1fa877232ff340f52147961749bd
Instruction ID: 10a0449a2a03693841c4c20968940954b3f431d54a0ad2ed78b88ba453f21664
Opcode Fuzzy Hash: 87057a8b95e8a5c78d102d4e606d6db87f0e1fa877232ff340f52147961749bd
Instruction Fuzzy Hash: 21C01234A5E0028B82448F04E8E5432A3F8A307208B00602ADA03E7361EE60C406890A

Function 00BD6094 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d578df2c5abf0030e182c286068beb6c72110511998a91de50152eefe9698044
Instruction ID: fd1b7aabc886b8c6cd54a85c929e474deaf78402e7d5ee91a3673dcb6b32e95d
Opcode Fuzzy Hash: d578df2c5abf0030e182c286068beb6c72110511998a91de50152eefe9698044
Instruction Fuzzy Hash: B8C09B3465C08087914CCF14D9D5475F3F79B97F14724B05FC8072B355E534D512951C

Function 00BA1A3C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15a864f76ad15a8745a76cfc3a621944a79a5f764c65f1e3b6b5a20e39631ce3
Instruction ID: 46fade4e2470699cc1f5526cb8ac4aae9e041a97c0f886b2f9cfe9cc9ce82c1f
Opcode Fuzzy Hash: 15a864f76ad15a8745a76cfc3a621944a79a5f764c65f1e3b6b5a20e39631ce3
Instruction Fuzzy Hash: 6FC04C24A9E0428A82448E89E9F1431E3E95307208B10743B9613E7361D960D4058909

Function 00BD5FD6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148035198.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2148021967.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000BF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000D71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148069464.0000000000E96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148328253.0000000000E97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148433996.0000000001034000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2148448380.0000000001035000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a291fba967dacc7f996a1b807acef46b8beb580488622e24a47bdb87adf3f01
Instruction ID: d9b648c0b36fa6db1473cb198b7377e1400162ccb6d769fecfb87db70a0e3f0d
Opcode Fuzzy Hash: 4a291fba967dacc7f996a1b807acef46b8beb580488622e24a47bdb87adf3f01
Instruction Fuzzy Hash: E7C09234B680808BA28CCF28DD95935F2FB9B8BE18B14B02DC807AB256E934D512860C

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
file.exe

Function 00BD50FA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63
libraryCOMMON

Function 00B9FCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Function 00B9D110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Function 00BD5BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 00BD695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Function 00BA049B Relevance: .3, Instructions: 264
COMMON

Function 00BA0228 Relevance: .2, Instructions: 218
COMMON

Function 00BD3220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Function 00BD3202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON