Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
OGBLsboKIF.exe

Overview

General Information

Sample name:OGBLsboKIF.exe
renamed because original name is a hash value
Original sample name:7cf2bae5bc432cbb1ce1e2e203a7784b.exe
Analysis ID:1579717
MD5:7cf2bae5bc432cbb1ce1e2e203a7784b
SHA1:1c78c832e0530ac569fb79d529a88944c6396dc7
SHA256:04c01bc45909f870c2683ac03de56386b5034a9edd4d28253fe8b243e63ba5c4
Tags:exeuser-abuse_ch
Infos:

Detection

LummaC
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected LummaC Stealer
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
LummaC encrypted strings found
Machine Learning detection for sample
Sample uses string decryption to hide its real strings
AV process strings found (often used to terminate AV products)
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Detected potential crypto function
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

  • System is w10x64
  • OGBLsboKIF.exe (PID: 3564 cmdline: "C:\Users\user\Desktop\OGBLsboKIF.exe" MD5: 7CF2BAE5BC432CBB1CE1E2E203A7784B)
    • WerFault.exe (PID: 4784 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 1672 MD5: C31336C1EFC2CCB44B4326EA793040F2)
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
Lumma Stealer, LummaC2 StealerLumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
{"C2 url": ["sustainskelet.lat", "discokeyus.lat", "rapeflowwj.lat", "aspecteirs.lat", "necklacebudi.lat", "crosshuaht.lat", "energyaffai.lat", "grannyejh.lat"], "Build id": "4h5VfH--"}
SourceRuleDescriptionAuthorStrings
00000004.00000002.1616248891.0000000002080000.00000040.00001000.00020000.00000000.sdmpWindows_Trojan_RedLineStealer_ed346e4cunknownunknown
  • 0x778:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmpWindows_Trojan_Smokeloader_3687686funknownunknown
  • 0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
decrypted.memstrJoeSecurity_LummaCStealer_2Yara detected LummaC StealerJoe Security
    No Sigma rule has matched
    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2024-12-23T08:00:45.677128+010020283713Unknown Traffic192.168.2.74969923.55.153.106443TCP
    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2024-12-23T08:00:43.469673+010020583541Domain Observed Used for C2 Detected192.168.2.7510451.1.1.153UDP
    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2024-12-23T08:00:41.684022+010020583581Domain Observed Used for C2 Detected192.168.2.7559631.1.1.153UDP
    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2024-12-23T08:00:42.294168+010020583601Domain Observed Used for C2 Detected192.168.2.7626571.1.1.153UDP
    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2024-12-23T08:00:43.238847+010020583621Domain Observed Used for C2 Detected192.168.2.7532151.1.1.153UDP
    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2024-12-23T08:00:41.913898+010020583641Domain Observed Used for C2 Detected192.168.2.7583051.1.1.153UDP
    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2024-12-23T08:00:42.977123+010020583701Domain Observed Used for C2 Detected192.168.2.7569821.1.1.153UDP
    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2024-12-23T08:00:43.915628+010020583741Domain Observed Used for C2 Detected192.168.2.7623551.1.1.153UDP
    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2024-12-23T08:00:43.691893+010020583761Domain Observed Used for C2 Detected192.168.2.7503371.1.1.153UDP
    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2024-12-23T08:00:46.427761+010028586661Domain Observed Used for C2 Detected192.168.2.74969923.55.153.106443TCP

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Source: OGBLsboKIF.exeAvira: detected
    Source: 4.3.OGBLsboKIF.exe.2100000.0.raw.unpackMalware Configuration Extractor: LummaC {"C2 url": ["sustainskelet.lat", "discokeyus.lat", "rapeflowwj.lat", "aspecteirs.lat", "necklacebudi.lat", "crosshuaht.lat", "energyaffai.lat", "grannyejh.lat"], "Build id": "4h5VfH--"}
    Source: OGBLsboKIF.exeReversingLabs: Detection: 44%
    Source: OGBLsboKIF.exeVirustotal: Detection: 38%Perma Link
    Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
    Source: OGBLsboKIF.exeJoe Sandbox ML: detected
    Source: 00000004.00000002.1616248891.0000000002080000.00000040.00001000.00020000.00000000.sdmpString decryptor: rapeflowwj.lat
    Source: 00000004.00000002.1616248891.0000000002080000.00000040.00001000.00020000.00000000.sdmpString decryptor: lid=%s&j=%s&ver=4.0
    Source: 00000004.00000002.1616248891.0000000002080000.00000040.00001000.00020000.00000000.sdmpString decryptor: TeslaBrowser/5.5
    Source: 00000004.00000002.1616248891.0000000002080000.00000040.00001000.00020000.00000000.sdmpString decryptor: - Screen Resoluton:
    Source: 00000004.00000002.1616248891.0000000002080000.00000040.00001000.00020000.00000000.sdmpString decryptor: - Physical Installed Memory:
    Source: 00000004.00000002.1616248891.0000000002080000.00000040.00001000.00020000.00000000.sdmpString decryptor: Workgroup: -
    Source: 00000004.00000002.1616248891.0000000002080000.00000040.00001000.00020000.00000000.sdmpString decryptor: 4h5VfH--

    Compliance

    barindex
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeUnpacked PE file: 4.2.OGBLsboKIF.exe.400000.0.unpack
    Source: OGBLsboKIF.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeFile opened: C:\Windows\SysWOW64\msvcr100.dllJump to behavior
    Source: unknownHTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.7:49699 version: TLS 1.2
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx esi, byte ptr [ebp+ebx-10h]4_2_0043C767
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then jmp eax4_2_0042984F
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax-0Dh]4_2_00423860
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov edx, ecx4_2_00438810
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then cmp dword ptr [edi+ebp*8], 5E874B5Fh4_2_00438810
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then cmp dword ptr [edx+edi*8], BC9C9AFCh4_2_00438810
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then test eax, eax4_2_00438810
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov byte ptr [edi], al4_2_0041682D
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax+18h]4_2_0041682D
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx ebx, byte ptr [esp+ecx-75h]4_2_0041682D
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov word ptr [ecx], bp4_2_0041D83A
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then push C0BFD6CCh4_2_00423086
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then push C0BFD6CCh4_2_00423086
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then add ebp, dword ptr [esp+0Ch]4_2_0042B170
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov eax, dword ptr [esp+00000080h]4_2_004179C1
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then cmp dword ptr [esi+edx*8], E5FE86B7h4_2_0043B1D0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ebx, eax4_2_0043B1D0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov word ptr [ecx], dx4_2_004291DD
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ecx, dword ptr [ebp-20h]4_2_004291DD
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ebx, eax4_2_00405990
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ebp, eax4_2_00405990
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ebx, esi4_2_00422190
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov word ptr [ebx], cx4_2_00422190
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then cmp word ptr [edi+eax+02h], 0000h4_2_00422190
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov byte ptr [edi], cl4_2_0042CA49
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov byte ptr [esi], al4_2_0042DA53
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx esi, byte ptr [esp+eax-7D4F867Fh]4_2_00416263
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax+61D008CBh]4_2_00415220
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then push esi4_2_00427AD3
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov byte ptr [edi], cl4_2_0042CAD0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov word ptr [ebx], ax4_2_0041B2E0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then push ebx4_2_0043CA93
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov word ptr [eax], cx4_2_0041CB40
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov word ptr [esi], cx4_2_0041CB40
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov word ptr [eax], cx4_2_00428B61
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov byte ptr [edi], cl4_2_0042CB11
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov byte ptr [edi], cl4_2_0042CB22
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax]4_2_0043F330
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ebx, eax4_2_0040DBD9
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ebx, eax4_2_0040DBD9
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx esi, byte ptr [esp+ecx-7D4F867Fh]4_2_00417380
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then cmp word ptr [ebx+edi+02h], 0000h4_2_0041D380
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then cmp al, 2Eh4_2_00426B95
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx ebx, byte ptr [edx]4_2_00435450
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx esi, byte ptr [esp+ecx-7D4F867Fh]4_2_00417380
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then push 00000000h4_2_00429C2B
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov word ptr [ecx], dx4_2_004291DD
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ecx, dword ptr [ebp-20h]4_2_004291DD
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]4_2_004074F0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx ecx, word ptr [edi+esi*4]4_2_004074F0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax+68E75405h]4_2_0043ECA0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then cmp dword ptr [ebx+edi*8], 9C259492h4_2_004385E0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then jmp eax4_2_004385E0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx edi, byte ptr [esp+ecx-7D4F88C7h]4_2_00417DEE
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ecx, eax4_2_00409580
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov word ptr [ebp+00h], ax4_2_00409580
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then jmp dword ptr [0044450Ch]4_2_00418591
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov eax, dword ptr [ebp-68h]4_2_00428D93
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then xor edi, edi4_2_0041759F
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov eax, dword ptr [0044473Ch]4_2_0041C653
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov edx, ebp4_2_00425E70
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then jmp dword ptr [004455F4h]4_2_00425E30
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ecx, eax4_2_0043AEC0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then xor byte ptr [esp+eax+17h], al4_2_00408F50
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov byte ptr [edi], bl4_2_00408F50
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ebx, dword ptr [edi+04h]4_2_0042A700
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then lea edx, dword ptr [ecx+01h]4_2_0040B70C
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov byte ptr [esi], al4_2_0041BF14
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov eax, dword ptr [ebx+edi+44h]4_2_00419F30
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax+423C9D38h]4_2_0041E7C0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx eax, word ptr [edx]4_2_004197C2
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov word ptr [edi], dx4_2_004197C2
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov word ptr [esi], cx4_2_004197C2
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ecx, ebx4_2_0042DFE9
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then jmp ecx4_2_0040BFFD
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov esi, eax4_2_00415799
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ecx, eax4_2_00415799
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax+68E75405h]4_2_0043EFB0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax+68E75405h]4_2_020EF217
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov word ptr [eax], cx4_2_020CD230
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov word ptr [esi], cx4_2_020CD230
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ecx, ebx4_2_020DE250
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then jmp ecx4_2_020BC264
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then push C0BFD6CCh4_2_020D32ED
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then add ebp, dword ptr [esp+0Ch]4_2_020DB3D7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ebx, esi4_2_020D23F7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov word ptr [ebx], cx4_2_020D23F7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then cmp word ptr [edi+eax+02h], 0000h4_2_020D23F7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax-0Dh]4_2_020D4031
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx edi, byte ptr [esp+ecx-7D4F88C7h]4_2_020C8055
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov edx, ebp4_2_020D60D7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ecx, eax4_2_020EB127
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov byte ptr [esi], al4_2_020CC17B
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov eax, dword ptr [ebx+edi+44h]4_2_020CA197
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then xor byte ptr [esp+eax+17h], al4_2_020B91B7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov byte ptr [edi], bl4_2_020B91B7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx ebx, byte ptr [edx]4_2_020E56B7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]4_2_020B7757
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx ecx, word ptr [edi+esi*4]4_2_020B7757
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ecx, eax4_2_020B97E7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov word ptr [ebp+00h], ax4_2_020B97E7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov word ptr [ecx], dx4_2_020D9444
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ecx, dword ptr [ebp-20h]4_2_020D9444
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax+61D008CBh]4_2_020C5487
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx esi, byte ptr [esp+eax-7D4F867Fh]4_2_020C64CA
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then jmp dword ptr [004455F4h]4_2_020D64DA
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov word ptr [ebx], ax4_2_020CB547
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax]4_2_020EF597
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx esi, byte ptr [esp+ecx-7D4F867Fh]4_2_020C75E7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then cmp word ptr [ebx+edi+02h], 0000h4_2_020CD5E7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx eax, word ptr [edx]4_2_020C9A29
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov word ptr [edi], dx4_2_020C9A29
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov word ptr [esi], cx4_2_020C9A29
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax+423C9D38h]4_2_020CEA27
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov edx, ecx4_2_020E8A77
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then cmp dword ptr [edi+ebp*8], 5E874B5Fh4_2_020E8A77
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then cmp dword ptr [edx+edi*8], BC9C9AFCh4_2_020E8A77
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then test eax, eax4_2_020E8A77
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov word ptr [ecx], bp4_2_020CDAB8
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then jmp eax4_2_020D9AB5
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx esi, byte ptr [esp+ecx+6D2CC012h]4_2_020C4ACD
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov byte ptr [edi], al4_2_020C6B2A
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax+6D2CC012h]4_2_020C4BD2
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ebx, eax4_2_020B5BF7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ebp, eax4_2_020B5BF7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then cmp dword ptr [ebx+edi*8], 9C259492h4_2_020E887B
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov eax, dword ptr [0044473Ch]4_2_020CC8BA
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ebx, dword ptr [edi+04h]4_2_020DA967
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then lea edx, dword ptr [ecx+01h]4_2_020BB973
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then jmp eax4_2_020E898E
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx esi, byte ptr [ebp+ebx-10h]4_2_020EC9CE
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ebx, eax4_2_020BDE40
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ebx, eax4_2_020BDE40
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then cmp dword ptr [ebp+edi*8+00h], E785F9BAh4_2_020C4E87
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then cmp dword ptr [ebp+edi*8+00h], AF697AECh4_2_020C4E96
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then cmp al, 2Eh4_2_020D6E96
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax+68E75405h]4_2_020EEF07
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax+18h]4_2_020C6F35
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then movzx ebx, byte ptr [esp+ecx-75h]4_2_020C6F35
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then push 00000000h4_2_020D9F40
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov eax, dword ptr [ebp-68h]4_2_020D8FA0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov ecx, eax4_2_020C5FD3
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov eax, dword ptr [esp+00000080h]4_2_020C7C28
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then xor edi, edi4_2_020C7C28
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov esi, eax4_2_020C5C41
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov byte ptr [esi], al4_2_020DDCBC
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov byte ptr [edi], cl4_2_020DCCB0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then push ebx4_2_020ECCFA
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then push esi4_2_020D7D1A
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov byte ptr [edi], cl4_2_020DCD37
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov byte ptr [edi], cl4_2_020DCD78
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov byte ptr [edi], cl4_2_020DCD89
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4x nop then mov word ptr [eax], cx4_2_020D8DC8

    Networking

    barindex
    Source: Network trafficSuricata IDS: 2058374 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat) : 192.168.2.7:62355 -> 1.1.1.1:53
    Source: Network trafficSuricata IDS: 2058370 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat) : 192.168.2.7:56982 -> 1.1.1.1:53
    Source: Network trafficSuricata IDS: 2058362 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat) : 192.168.2.7:53215 -> 1.1.1.1:53
    Source: Network trafficSuricata IDS: 2058354 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat) : 192.168.2.7:51045 -> 1.1.1.1:53
    Source: Network trafficSuricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.7:58305 -> 1.1.1.1:53
    Source: Network trafficSuricata IDS: 2058376 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat) : 192.168.2.7:50337 -> 1.1.1.1:53
    Source: Network trafficSuricata IDS: 2058360 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat) : 192.168.2.7:62657 -> 1.1.1.1:53
    Source: Network trafficSuricata IDS: 2058358 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat) : 192.168.2.7:55963 -> 1.1.1.1:53
    Source: Network trafficSuricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.7:49699 -> 23.55.153.106:443
    Source: Malware configuration extractorURLs: sustainskelet.lat
    Source: Malware configuration extractorURLs: discokeyus.lat
    Source: Malware configuration extractorURLs: rapeflowwj.lat
    Source: Malware configuration extractorURLs: aspecteirs.lat
    Source: Malware configuration extractorURLs: necklacebudi.lat
    Source: Malware configuration extractorURLs: crosshuaht.lat
    Source: Malware configuration extractorURLs: energyaffai.lat
    Source: Malware configuration extractorURLs: grannyejh.lat
    Source: Joe Sandbox ViewIP Address: 23.55.153.106 23.55.153.106
    Source: Joe Sandbox ViewJA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
    Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49699 -> 23.55.153.106:443
    Source: global trafficHTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: global trafficHTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: 7QContent-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=57a979f2c82b2474b8b734c3; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type25665Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveMon, 23 Dec 2024 07:00:46 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control]]d equals www.youtube.com (Youtube)
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
    Source: global trafficDNS traffic detected: DNS query: crosshuaht.lat
    Source: global trafficDNS traffic detected: DNS query: grannyejh.lat
    Source: global trafficDNS traffic detected: DNS query: discokeyus.lat
    Source: global trafficDNS traffic detected: DNS query: necklacebudi.lat
    Source: global trafficDNS traffic detected: DNS query: energyaffai.lat
    Source: global trafficDNS traffic detected: DNS query: aspecteirs.lat
    Source: global trafficDNS traffic detected: DNS query: sustainskelet.lat
    Source: global trafficDNS traffic detected: DNS query: rapeflowwj.lat
    Source: global trafficDNS traffic detected: DNS query: steamcommunity.com
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://127.0.0.1:27060
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615953289.0000000000527000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615953289.0000000000527000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://store.steampowered.com/privacy_agreement/
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615953289.0000000000527000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://store.steampowered.com/subscriber_agreement/
    Source: Amcache.hve.10.drString found in binary or memory: http://upx.sf.net
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.valvesoftware.com/legal.htm
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.steampowered.com/
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://broadcast.st.dl.eccdnx.com
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://checkout.steampowered.com/
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615953289.0000000000527000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1330472934.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1331160552.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1330472934.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1331160552.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=engli
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1330472934.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1331160552.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615953289.0000000000527000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615953289.0000000000527000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615953289.0000000000527000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615953289.0000000000527000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=hyEE
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1330472934.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1331160552.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1330472934.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1331160552.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1330472934.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1331160552.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1330472934.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1331160552.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://help.steampowered.com/
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://help.steampowered.com/en/
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.steampowered.com/
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://lv.queniujq.cn
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://medal.tv
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://player.vimeo.com
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://recaptcha.net
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://recaptcha.net/recaptcha/;
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://s.ytimg.com;
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sketchfab.com
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steam.tv/
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steambroadcast-test.akamaized.net
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steambroadcast.akamaized.net
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steambroadcastchat.akamaized.net
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615953289.0000000000527000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/
    Source: OGBLsboKIF.exe, 00000004.00000003.1330472934.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1331160552.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/6
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/discussions/
    Source: OGBLsboKIF.exe, 00000004.00000003.1329705976.00000000004D1000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615737063.00000000004D1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.or
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615953289.0000000000527000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/market/
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/my/wishlist/
    Source: OGBLsboKIF.exe, 00000004.00000002.1615583122.000000000049C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
    Source: OGBLsboKIF.exe, 00000004.00000002.1615737063.00000000004B8000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329705976.00000000004B7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/profiles/76561199724331900r
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/workshop/
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/;
    Source: OGBLsboKIF.exe, 00000004.00000003.1330472934.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1331160552.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/about/
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/explore/
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615953289.0000000000527000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/legal/
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/mobile
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/news/
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/points/shop
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/points/shop/
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/privacy_agreement/
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/stats/
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/steam_refunds/
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/subscriber_agreement/
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/recaptcha/
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.cn/recaptcha/
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com/recaptcha/
    Source: OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com
    Source: OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/
    Source: unknownNetwork traffic detected: HTTP traffic on port 49699 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49699
    Source: unknownHTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.7:49699 version: TLS 1.2
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004329C0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,4_2_004329C0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004329C0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,4_2_004329C0

    System Summary

    barindex
    Source: 00000004.00000002.1616248891.0000000002080000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
    Source: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004088504_2_00408850
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0040ACF04_2_0040ACF0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004238604_2_00423860
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004388104_2_00438810
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0041682D4_2_0041682D
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004288CB4_2_004288CB
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0043D8804_2_0043D880
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004218A04_2_004218A0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004309404_2_00430940
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004039704_2_00403970
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004209394_2_00420939
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004179C14_2_004179C1
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004231C24_2_004231C2
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004241C04_2_004241C0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0043B1D04_2_0043B1D0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004291DD4_2_004291DD
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0043D9804_2_0043D980
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004059904_2_00405990
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004221904_2_00422190
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0043D9974_2_0043D997
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0043D9994_2_0043D999
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004091B04_2_004091B0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0042CA494_2_0042CA49
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0042DA534_2_0042DA53
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004162634_2_00416263
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0040EA104_2_0040EA10
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004152204_2_00415220
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0042CAD04_2_0042CAD0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004252DD4_2_004252DD
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0041B2E04_2_0041B2E0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004062804_2_00406280
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0043DA804_2_0043DA80
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0041E2904_2_0041E290
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0041CB404_2_0041CB40
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0043D34D4_2_0043D34D
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_00426B504_2_00426B50
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0043DB604_2_0043DB60
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_00436B084_2_00436B08
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0042830D4_2_0042830D
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0042CB114_2_0042CB11
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004043204_2_00404320
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0042CB224_2_0042CB22
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004253274_2_00425327
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004083304_2_00408330
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0043F3304_2_0043F330
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0042A33F4_2_0042A33F
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0040DBD94_2_0040DBD9
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004243804_2_00424380
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0041FC754_2_0041FC75
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0041DC004_2_0041DC00
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_00429C2B4_2_00429C2B
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004291DD4_2_004291DD
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004074F04_2_004074F0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0041148F4_2_0041148F
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0042AC904_2_0042AC90
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0043ECA04_2_0043ECA0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0040CD464_2_0040CD46
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004375004_2_00437500
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004225104_2_00422510
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_00417DEE4_2_00417DEE
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_00437DF04_2_00437DF0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004095804_2_00409580
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0041759F4_2_0041759F
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_00425E704_2_00425E70
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_00436E744_2_00436E74
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004276034_2_00427603
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_00425E304_2_00425E30
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004286C04_2_004286C0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0043AEC04_2_0043AEC0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004266D04_2_004266D0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004236E24_2_004236E2
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_00405EE04_2_00405EE0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0041DE804_2_0041DE80
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_00402F504_2_00402F50
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_00420F504_2_00420F50
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_00438F594_2_00438F59
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004067104_2_00406710
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_00423F204_2_00423F20
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0043F7204_2_0043F720
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_00419F304_2_00419F30
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0041E7C04_2_0041E7C0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004197C24_2_004197C2
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0042DFE94_2_0042DFE9
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0040A7804_2_0040A780
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_00411F904_2_00411F90
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004187924_2_00418792
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004157994_2_00415799
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0043EFB04_2_0043EFB0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020EF2174_2_020EF217
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020CD2304_2_020CD230
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020DE2504_2_020DE250
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020D23F74_2_020D23F7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020C80554_2_020C8055
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020E80574_2_020E8057
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020E70DB4_2_020E70DB
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020D60D74_2_020D60D7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020CE0E74_2_020CE0E7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020EB1274_2_020EB127
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020B61474_2_020B6147
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020D31664_2_020D3166
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020CA1974_2_020CA197
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020D11B74_2_020D11B7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020C21F74_2_020C21F7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020D46874_2_020D4687
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020D56944_2_020D5694
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020C16F64_2_020C16F6
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020B77574_2_020B7757
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020E77674_2_020E7767
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020D27774_2_020D2777
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020B97E74_2_020B97E7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020B94174_2_020B9417
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020D94444_2_020D9444
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020B64E74_2_020B64E7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020CE4F74_2_020CE4F7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020D351D4_2_020D351D
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020CB5474_2_020CB547
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020B45874_2_020B4587
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020EF5974_2_020EF597
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020B85974_2_020B8597
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020ED5B44_2_020ED5B4
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020C9A294_2_020C9A29
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020CEA274_2_020CEA27
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020E8A774_2_020E8A77
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020B8AB74_2_020B8AB7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020D1B074_2_020D1B07
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020E0BA74_2_020E0BA7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020D0BA04_2_020D0BA0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020B3BD74_2_020B3BD7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020B5BF74_2_020B5BF7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020C78064_2_020C7806
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020D89274_2_020D8927
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020D69374_2_020D6937
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020B69774_2_020B6977
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020EF9874_2_020EF987
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020BA9E74_2_020BA9E7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020BDE404_2_020BDE40
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020CDE674_2_020CDE67
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020CCE634_2_020CCE63
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020CFEDC4_2_020CFEDC
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020DAEF74_2_020DAEF7
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020EEF074_2_020EEF07
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020C6F354_2_020C6F35
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020BCFAD4_2_020BCFAD
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020BEC774_2_020BEC77
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020DDCBC4_2_020DDCBC
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020DCCB04_2_020DCCB0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020DCD374_2_020DCD37
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020E6D6F4_2_020E6D6F
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020DCD784_2_020DCD78
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020DCD894_2_020DCD89
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: String function: 00408030 appears 42 times
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: String function: 00414400 appears 65 times
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: String function: 020C4667 appears 65 times
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: String function: 020B8297 appears 72 times
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 1672
    Source: OGBLsboKIF.exe, 00000004.00000000.1268118962.000000000044B000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamesDefence0 vs OGBLsboKIF.exe
    Source: OGBLsboKIF.exe, 00000004.00000003.1278275939.00000000004D2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesDefence0 vs OGBLsboKIF.exe
    Source: OGBLsboKIF.exeBinary or memory string: OriginalFilenamesDefence0 vs OGBLsboKIF.exe
    Source: OGBLsboKIF.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
    Source: 00000004.00000002.1616248891.0000000002080000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
    Source: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
    Source: OGBLsboKIF.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: classification engineClassification label: mal100.troj.evad.winEXE@2/5@9/1
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020807A6 CreateToolhelp32Snapshot,Module32First,4_2_020807A6
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_00430C70 CoCreateInstance,4_2_00430C70
    Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3564
    Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\135f3731-e223-4f50-8c79-7047be02af98Jump to behavior
    Source: OGBLsboKIF.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: OGBLsboKIF.exeReversingLabs: Detection: 44%
    Source: OGBLsboKIF.exeVirustotal: Detection: 38%
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeFile read: C:\Users\user\Desktop\OGBLsboKIF.exeJump to behavior
    Source: unknownProcess created: C:\Users\user\Desktop\OGBLsboKIF.exe "C:\Users\user\Desktop\OGBLsboKIF.exe"
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 1672
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: winhttp.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: msimg32.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: msvcr100.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: webio.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: mswsock.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: winnsi.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: dnsapi.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: rasadhlp.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: fwpuclnt.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: schannel.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: mskeyprotect.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: ntasn1.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: ncrypt.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: ncryptsslp.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeSection loaded: dpapi.dllJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeFile opened: C:\Windows\SysWOW64\msvcr100.dllJump to behavior

    Data Obfuscation

    barindex
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeUnpacked PE file: 4.2.OGBLsboKIF.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeUnpacked PE file: 4.2.OGBLsboKIF.exe.400000.0.unpack
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0043D810 push eax; mov dword ptr [esp], 707F7E0Dh4_2_0043D812
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_00441895 push 0000002Dh; retf 4_2_0044189D
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004419BC push esi; iretd 4_2_00441A51
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_00441A36 push esi; iretd 4_2_00441A51
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_00443469 push ebp; iretd 4_2_0044346C
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0044366E push 9F00CD97h; ret 4_2_004436B1
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0043AE30 push eax; mov dword ptr [esp], 1D1E1F10h4_2_0043AE3E
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_004477A5 push ebp; iretd 4_2_004477AA
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0208582A push ss; retf 4_2_0208589B
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020858AD push ss; retf 4_2_0208589B
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_02083480 push ebp; ret 4_2_02083483
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020814DC push 00000039h; ret 4_2_020815B3
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_02081545 push 00000039h; ret 4_2_020815B3
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0208156B push 00000039h; ret 4_2_020815B3
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020EB097 push eax; mov dword ptr [esp], 1D1E1F10h4_2_020EB0A5
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020D3A79 push esp; iretd 4_2_020D3A7C
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020EDA77 push eax; mov dword ptr [esp], 707F7E0Dh4_2_020EDA79
    Source: OGBLsboKIF.exeStatic PE information: section name: .text entropy: 7.789421285359389
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\OGBLsboKIF.exe TID: 7032Thread sleep time: -30000s >= -30000sJump to behavior
    Source: Amcache.hve.10.drBinary or memory string: VMware
    Source: Amcache.hve.10.drBinary or memory string: VMware Virtual USB Mouse
    Source: OGBLsboKIF.exe, 00000004.00000002.1615836754.00000000004D7000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW{
    Source: Amcache.hve.10.drBinary or memory string: vmci.syshbin
    Source: Amcache.hve.10.drBinary or memory string: VMware, Inc.
    Source: Amcache.hve.10.drBinary or memory string: VMware20,1hbin@
    Source: Amcache.hve.10.drBinary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
    Source: Amcache.hve.10.drBinary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
    Source: Amcache.hve.10.drBinary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
    Source: OGBLsboKIF.exe, 00000004.00000002.1615836754.00000000004D7000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
    Source: Amcache.hve.10.drBinary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
    Source: OGBLsboKIF.exe, 00000004.00000002.1615583122.000000000048B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWh
    Source: Amcache.hve.10.drBinary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
    Source: Amcache.hve.10.drBinary or memory string: c:/windows/system32/drivers/vmci.sys
    Source: Amcache.hve.10.drBinary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
    Source: Amcache.hve.10.drBinary or memory string: vmci.sys
    Source: Amcache.hve.10.drBinary or memory string: vmci.syshbin`
    Source: Amcache.hve.10.drBinary or memory string: \driver\vmci,\driver\pci
    Source: Amcache.hve.10.drBinary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
    Source: Amcache.hve.10.drBinary or memory string: VMware20,1
    Source: Amcache.hve.10.drBinary or memory string: Microsoft Hyper-V Generation Counter
    Source: Amcache.hve.10.drBinary or memory string: NECVMWar VMware SATA CD00
    Source: Amcache.hve.10.drBinary or memory string: VMware Virtual disk SCSI Disk Device
    Source: Amcache.hve.10.drBinary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
    Source: Amcache.hve.10.drBinary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
    Source: Amcache.hve.10.drBinary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
    Source: Amcache.hve.10.drBinary or memory string: VMware PCI VMCI Bus Device
    Source: Amcache.hve.10.drBinary or memory string: VMware VMCI Bus Device
    Source: Amcache.hve.10.drBinary or memory string: VMware Virtual RAM
    Source: Amcache.hve.10.drBinary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
    Source: Amcache.hve.10.drBinary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
    Source: Amcache.hve.10.drBinary or memory string: vmci.inf_amd64_68ed49469341f563
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_0043C1F0 LdrInitializeThunk,4_2_0043C1F0
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_02080083 push dword ptr fs:[00000030h]4_2_02080083
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020B092B mov eax, dword ptr fs:[00000030h]4_2_020B092B
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeCode function: 4_2_020B0D90 mov eax, dword ptr fs:[00000030h]4_2_020B0D90

    HIPS / PFW / Operating System Protection Evasion

    barindex
    Source: OGBLsboKIF.exeString found in binary or memory: rapeflowwj.lat
    Source: OGBLsboKIF.exeString found in binary or memory: crosshuaht.lat
    Source: OGBLsboKIF.exeString found in binary or memory: sustainskelet.lat
    Source: OGBLsboKIF.exeString found in binary or memory: aspecteirs.lat
    Source: OGBLsboKIF.exeString found in binary or memory: energyaffai.lat
    Source: OGBLsboKIF.exeString found in binary or memory: necklacebudi.lat
    Source: OGBLsboKIF.exeString found in binary or memory: discokeyus.lat
    Source: OGBLsboKIF.exeString found in binary or memory: grannyejh.lat
    Source: C:\Users\user\Desktop\OGBLsboKIF.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
    Source: Amcache.hve.10.drBinary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
    Source: Amcache.hve.10.drBinary or memory string: msmpeng.exe
    Source: Amcache.hve.10.drBinary or memory string: c:\program files\windows defender\msmpeng.exe
    Source: Amcache.hve.10.drBinary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
    Source: Amcache.hve.10.drBinary or memory string: MsMpEng.exe

    Stealing of Sensitive Information

    barindex
    Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR

    Remote Access Functionality

    barindex
    Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR
    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
    PowerShell
    1
    DLL Side-Loading
    1
    Process Injection
    1
    Virtualization/Sandbox Evasion
    OS Credential Dumping11
    Security Software Discovery
    Remote Services1
    Archive Collected Data
    11
    Encrypted Channel
    Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
    DLL Side-Loading
    1
    Process Injection
    LSASS Memory1
    Virtualization/Sandbox Evasion
    Remote Desktop Protocol2
    Clipboard Data
    1
    Ingress Tool Transfer
    Exfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)11
    Deobfuscate/Decode Files or Information
    Security Account Manager1
    Process Discovery
    SMB/Windows Admin SharesData from Network Shared Drive2
    Non-Application Layer Protocol
    Automated ExfiltrationData Encrypted for Impact
    Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook4
    Obfuscated Files or Information
    NTDS2
    System Information Discovery
    Distributed Component Object ModelInput Capture113
    Application Layer Protocol
    Traffic DuplicationData Destruction
    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script22
    Software Packing
    LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
    DLL Side-Loading
    Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand
    SourceDetectionScannerLabelLink
    OGBLsboKIF.exe45%ReversingLabsWin32.Trojan.CrypterX
    OGBLsboKIF.exe39%VirustotalBrowse
    OGBLsboKIF.exe100%AviraHEUR/AGEN.1306978
    OGBLsboKIF.exe100%Joe Sandbox ML
    No Antivirus matches
    No Antivirus matches
    No Antivirus matches
    No Antivirus matches
    NameIPActiveMaliciousAntivirus DetectionReputation
    steamcommunity.com
    23.55.153.106
    truefalse
      high
      sustainskelet.lat
      unknown
      unknownfalse
        high
        crosshuaht.lat
        unknown
        unknownfalse
          high
          rapeflowwj.lat
          unknown
          unknownfalse
            high
            grannyejh.lat
            unknown
            unknownfalse
              high
              aspecteirs.lat
              unknown
              unknownfalse
                high
                discokeyus.lat
                unknown
                unknownfalse
                  high
                  energyaffai.lat
                  unknown
                  unknownfalse
                    high
                    necklacebudi.lat
                    unknown
                    unknownfalse
                      high
                      NameMaliciousAntivirus DetectionReputation
                      necklacebudi.latfalse
                        high
                        aspecteirs.latfalse
                          high
                          sustainskelet.latfalse
                            high
                            crosshuaht.latfalse
                              high
                              rapeflowwj.latfalse
                                high
                                https://steamcommunity.com/profiles/76561199724331900false
                                  high
                                  energyaffai.latfalse
                                    high
                                    grannyejh.latfalse
                                      high
                                      discokeyus.latfalse
                                        high
                                        NameSourceMaliciousAntivirus DetectionReputation
                                        https://steamcommunity.com/my/wishlist/OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                          high
                                          https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.pngOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpfalse
                                            high
                                            https://player.vimeo.comOGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                              high
                                              https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1330472934.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1331160552.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                high
                                                https://steamcommunity.com/?subsection=broadcastsOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  high
                                                  https://help.steampowered.com/en/OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    high
                                                    https://steamcommunity.com/market/OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      high
                                                      https://store.steampowered.com/news/OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        high
                                                        https://store.steampowered.com/subscriber_agreement/OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          high
                                                          https://www.gstatic.cn/recaptcha/OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            high
                                                            http://store.steampowered.com/subscriber_agreement/OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615953289.0000000000527000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              high
                                                              https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.orgOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615953289.0000000000527000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                high
                                                                https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=hyEEOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615953289.0000000000527000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  high
                                                                  https://recaptcha.net/recaptcha/;OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    high
                                                                    http://www.valvesoftware.com/legal.htmOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      high
                                                                      https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=enOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1330472934.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1331160552.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        high
                                                                        https://steamcommunity.com/discussions/OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          high
                                                                          https://www.youtube.comOGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            high
                                                                            https://www.google.comOGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              high
                                                                              https://store.steampowered.com/stats/OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                high
                                                                                https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&amOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  high
                                                                                  https://medal.tvOGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    high
                                                                                    https://broadcast.st.dl.eccdnx.comOGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      high
                                                                                      https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.pngOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        high
                                                                                        https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&aOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1330472934.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1331160552.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          high
                                                                                          https://store.steampowered.com/steam_refunds/OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            high
                                                                                            https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20FeedbackOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              high
                                                                                              https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&aOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615953289.0000000000527000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                high
                                                                                                https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  high
                                                                                                  https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615953289.0000000000527000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    high
                                                                                                    https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      high
                                                                                                      https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        high
                                                                                                        https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=englOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1330472934.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1331160552.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          high
                                                                                                          https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbCOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            high
                                                                                                            https://s.ytimg.com;OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              high
                                                                                                              https://steamcommunity.com/workshop/OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                high
                                                                                                                https://login.steampowered.com/OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  high
                                                                                                                  https://steamcommunity.com/6OGBLsboKIF.exe, 00000004.00000003.1330472934.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1331160552.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    high
                                                                                                                    https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbbOGBLsboKIF.exe, 00000004.00000003.1330472934.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1331160552.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      high
                                                                                                                      https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_cOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1330472934.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1331160552.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        high
                                                                                                                        https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615953289.0000000000527000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          high
                                                                                                                          https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1330472934.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1331160552.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            high
                                                                                                                            https://store.steampowered.com/legal/OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615953289.0000000000527000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              high
                                                                                                                              https://community.fastly.steamstatic.com/OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                high
                                                                                                                                https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=engliOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1330472934.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1331160552.00000000004E3000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  high
                                                                                                                                  https://steam.tv/OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    high
                                                                                                                                    https://steamcommunity.com/profiles/76561199724331900rOGBLsboKIF.exe, 00000004.00000002.1615737063.00000000004B8000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329705976.00000000004B7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      high
                                                                                                                                      https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=enOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        high
                                                                                                                                        https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=engOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          high
                                                                                                                                          http://store.steampowered.com/privacy_agreement/OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615953289.0000000000527000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            high
                                                                                                                                            https://store.steampowered.com/points/shop/OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              high
                                                                                                                                              https://recaptcha.netOGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                high
                                                                                                                                                http://upx.sf.netAmcache.hve.10.drfalse
                                                                                                                                                  high
                                                                                                                                                  https://store.steampowered.com/OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    high
                                                                                                                                                    https://steamcommunity.comOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615953289.0000000000527000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      high
                                                                                                                                                      https://sketchfab.comOGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        high
                                                                                                                                                        https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.orOGBLsboKIF.exe, 00000004.00000003.1329705976.00000000004D1000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615737063.00000000004D1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          high
                                                                                                                                                          https://lv.queniujq.cnOGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            high
                                                                                                                                                            https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.pngOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              high
                                                                                                                                                              https://www.youtube.com/OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                high
                                                                                                                                                                http://127.0.0.1:27060OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  high
                                                                                                                                                                  https://store.steampowered.com/privacy_agreement/OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    high
                                                                                                                                                                    https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      high
                                                                                                                                                                      https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&amOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        high
                                                                                                                                                                        https://www.google.com/recaptcha/OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          high
                                                                                                                                                                          https://checkout.steampowered.com/OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            high
                                                                                                                                                                            https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&ampOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              high
                                                                                                                                                                              https://help.steampowered.com/OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                high
                                                                                                                                                                                https://api.steampowered.com/OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  high
                                                                                                                                                                                  https://store.steampowered.com/points/shopOGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    high
                                                                                                                                                                                    http://store.steampowered.com/account/cookiepreferences/OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615953289.0000000000527000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329648604.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                      high
                                                                                                                                                                                      https://store.steampowered.com/mobileOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                        high
                                                                                                                                                                                        https://steamcommunity.com/OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                          high
                                                                                                                                                                                          https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000002.1615953289.0000000000527000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            high
                                                                                                                                                                                            https://store.steampowered.com/;OGBLsboKIF.exe, 00000004.00000002.1615915661.00000000004E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                              high
                                                                                                                                                                                              https://store.steampowered.com/about/OGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                high
                                                                                                                                                                                                https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&lOGBLsboKIF.exe, 00000004.00000003.1329286171.0000000000521000.00000004.00000020.00020000.00000000.sdmp, OGBLsboKIF.exe, 00000004.00000003.1329286171.000000000051C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  high
                                                                                                                                                                                                  • No. of IPs < 25%
                                                                                                                                                                                                  • 25% < No. of IPs < 50%
                                                                                                                                                                                                  • 50% < No. of IPs < 75%
                                                                                                                                                                                                  • 75% < No. of IPs
                                                                                                                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                  23.55.153.106
                                                                                                                                                                                                  steamcommunity.comUnited States
                                                                                                                                                                                                  20940AKAMAI-ASN1EUfalse
                                                                                                                                                                                                  Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                  Analysis ID:1579717
                                                                                                                                                                                                  Start date and time:2024-12-23 07:59:44 +01:00
                                                                                                                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                                                                                                                  Overall analysis duration:0h 5m 9s
                                                                                                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                                                                                                  Report type:full
                                                                                                                                                                                                  Cookbook file name:default.jbs
                                                                                                                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                  Number of analysed new started processes analysed:16
                                                                                                                                                                                                  Number of new started drivers analysed:0
                                                                                                                                                                                                  Number of existing processes analysed:0
                                                                                                                                                                                                  Number of existing drivers analysed:0
                                                                                                                                                                                                  Number of injected processes analysed:0
                                                                                                                                                                                                  Technologies:
                                                                                                                                                                                                  • HCA enabled
                                                                                                                                                                                                  • EGA enabled
                                                                                                                                                                                                  • AMSI enabled
                                                                                                                                                                                                  Analysis Mode:default
                                                                                                                                                                                                  Analysis stop reason:Timeout
                                                                                                                                                                                                  Sample name:OGBLsboKIF.exe
                                                                                                                                                                                                  renamed because original name is a hash value
                                                                                                                                                                                                  Original Sample Name:7cf2bae5bc432cbb1ce1e2e203a7784b.exe
                                                                                                                                                                                                  Detection:MAL
                                                                                                                                                                                                  Classification:mal100.troj.evad.winEXE@2/5@9/1
                                                                                                                                                                                                  EGA Information:
                                                                                                                                                                                                  • Successful, ratio: 100%
                                                                                                                                                                                                  HCA Information:
                                                                                                                                                                                                  • Successful, ratio: 92%
                                                                                                                                                                                                  • Number of executed functions: 11
                                                                                                                                                                                                  • Number of non-executed functions: 216
                                                                                                                                                                                                  Cookbook Comments:
                                                                                                                                                                                                  • Found application associated with file extension: .exe
                                                                                                                                                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                                                                                                                                                                                  • Excluded IPs from analysis (whitelisted): 52.168.117.173, 13.107.246.63, 40.126.53.21, 20.109.210.53
                                                                                                                                                                                                  • Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, otelrules.azureedge.net, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                  • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                  TimeTypeDescription
                                                                                                                                                                                                  02:00:41API Interceptor4x Sleep call for process: OGBLsboKIF.exe modified
                                                                                                                                                                                                  03:14:06API Interceptor1x Sleep call for process: WerFault.exe modified
                                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                  23.55.153.106NfwBtCx5PR.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                    pJRiqnTih0.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                      5XXofntDiN.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                        xxLuwS60RS.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                          5RjjCWZAVv.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                            s31ydU1MpQ.exeGet hashmaliciousLummaC, StealcBrowse
                                                                                                                                                                                                              TmmiCE5Ulm.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                9pyUjy2elE.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                  0gnHF2twcT.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                    20yLTIU4mS.exeGet hashmaliciousLummaC, StealcBrowse
                                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                      steamcommunity.comNfwBtCx5PR.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      pJRiqnTih0.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      5XXofntDiN.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      xxLuwS60RS.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      5RjjCWZAVv.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      s31ydU1MpQ.exeGet hashmaliciousLummaC, StealcBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      TmmiCE5Ulm.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      9pyUjy2elE.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      0gnHF2twcT.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      20yLTIU4mS.exeGet hashmaliciousLummaC, StealcBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                      AKAMAI-ASN1EUNfwBtCx5PR.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      pJRiqnTih0.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      5XXofntDiN.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      xxLuwS60RS.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      5RjjCWZAVv.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      s31ydU1MpQ.exeGet hashmaliciousLummaC, StealcBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      TmmiCE5Ulm.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      9pyUjy2elE.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      0gnHF2twcT.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      20yLTIU4mS.exeGet hashmaliciousLummaC, StealcBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                      a0e9f5d64349fb13191bc781f81f42e1U8mbM8r793.exeGet hashmaliciousLummaC, StealcBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      ABnDy7rLFS.exeGet hashmaliciousLummaC, StealcBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      skIYOAOzvU.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      NfwBtCx5PR.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      spoolsv.COM.exeGet hashmaliciousDBatLoaderBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      pJRiqnTih0.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      5XXofntDiN.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      xxLuwS60RS.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      schost.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      5RjjCWZAVv.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                      • 23.55.153.106
                                                                                                                                                                                                                      No context
                                                                                                                                                                                                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):65536
                                                                                                                                                                                                                      Entropy (8bit):0.9581632610555575
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:Xuq3lTS0S0sJhrL72f2QXIDcQPc6GcEycw3cJVP+HbHg/TgJ3YOZUXWIOy4H9vxZ:+q3UT0n0RC4ljRmRzuiFvZ24IO8S
                                                                                                                                                                                                                      MD5:6810FBB67F21162BC32E138FE1830CDB
                                                                                                                                                                                                                      SHA1:A9628C26676CB4A1769644D66F6C119EA4F3A957
                                                                                                                                                                                                                      SHA-256:674719C099F60E7CEEB4BDF49929A7C306A45D7C5159AADCF23C1C63DC69B75B
                                                                                                                                                                                                                      SHA-512:13D45E08E86124515ABA00F18FE255576E24DC15CC62DECAF17578ACE1A5B17187FE68B4EA3DBB2D0C848F54583E8A0FC0F03BC3FECB0C8430B7BD2D28BF3325
                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                      Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.4.1.0.8.4.7.0.1.1.1.2.3.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.4.1.0.8.4.7.4.4.8.6.4.1.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.b.5.d.0.e.7.0.-.e.e.c.4.-.4.1.c.c.-.a.6.7.6.-.d.9.1.c.a.4.2.d.4.0.8.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.a.c.2.b.d.b.6.-.e.e.5.a.-.4.2.e.5.-.8.b.3.1.-.a.e.d.3.f.0.d.d.9.6.4.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.O.G.B.L.s.b.o.K.I.F...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.e.c.-.0.0.0.1.-.0.0.1.4.-.5.f.6.5.-.3.3.6.0.0.8.5.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.8.5.8.5.2.b.7.d.e.6.9.6.6.a.c.8.a.5.9.8.0.6.e.b.6.e.1.5.4.7.5.0.0.0.0.f.f.f.f.!.0.0.0.0.1.c.7.8.c.8.3.2.e.0.5.3.0.a.c.5.6.9.f.b.7.9.d.5.2.9.a.8.8.9.4.4.c.6.3.9.6.d.c.7.!.O.G.B.L.s.b.o.K.I.F...e.x.e.....T.a.r.g.e.t.A.p.p.
                                                                                                                                                                                                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                      File Type:Mini DuMP crash report, 15 streams, Mon Dec 23 07:00:47 2024, 0x1205a4 type
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):50186
                                                                                                                                                                                                                      Entropy (8bit):2.7368990230638346
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:Mh9DH/LBbZPSP1hcjAMLIxeBpGmCOWvu6F:Mh9bLBbZUaEML3GDk6F
                                                                                                                                                                                                                      MD5:4EE6DAC14FD3EDDA3B9ECB95AE858FFE
                                                                                                                                                                                                                      SHA1:E64FACBD251D666437733018F41EBB276EE60FD1
                                                                                                                                                                                                                      SHA-256:F55773B477CF793AF206D06141D7C63459A3DA9F9FC3663A4285715E6164BFAA
                                                                                                                                                                                                                      SHA-512:03F734DBDE4F66E3A014E4B84773ECF7059DEBDF3BBC2E319CE1276924832188B64ED876B3275D1C2E81430C94FFC2DF7C858DBDB503BE3FAFBD7A76E962ADB9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                      Preview:MDMP..a..... .........ig............4...............H.......l...<............,..........`.......8...........T............@..J.......................................................................................................eJ......, ......GenuineIntel............T.............ig.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):8310
                                                                                                                                                                                                                      Entropy (8bit):3.7022400193668785
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:R6l7wVeJpG6MM6YNwSU9azKgmfdkpDr89bg8sf0z3RAm:R6lXJY6l6YqSU9a+gmfdFgPfe3j
                                                                                                                                                                                                                      MD5:B360C37B2274EFA8C9CFA8164BE0E1C6
                                                                                                                                                                                                                      SHA1:D0AA8860E9AD7BED5242E4BEB3D51863E881A0A8
                                                                                                                                                                                                                      SHA-256:018102E5F457BE02D943A0B7FB9DFFAAE1F5BD7CB3FC70E09098A5E8A3A611C1
                                                                                                                                                                                                                      SHA-512:FC8D354F8EE585D968D28867BF14511BCA46FE9D718EBABA24C4BA8BB00A9FDD1FBAF863F3ED83C6071F9A79B1A3A2AB1D15734588250FC72E4F6BE346347644
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.5.6.4.<./.P.i.
                                                                                                                                                                                                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4579
                                                                                                                                                                                                                      Entropy (8bit):4.484333760524931
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:cvIwWl8zsnvJg77aI9gTnWpW8VYHYm8M4JZK6pFviTz+q8IBpkNgQzugd:uIjfnRI7yTW7VTJ0vOPzugd
                                                                                                                                                                                                                      MD5:FE6DCD601784635280BE16394CFDB470
                                                                                                                                                                                                                      SHA1:C22AE5DBB6F267739294FC5E6907F9DFB6D267DE
                                                                                                                                                                                                                      SHA-256:EBD5DB9B113C709D05C246ED5FB220A0828B9A4639671C1C9CC7B53F80996605
                                                                                                                                                                                                                      SHA-512:5F6AA7ABF45CF132563F7628D33967EC968AE9D65732A92F6641271F7DD2A8E5B09F3C0AD1A4DDBCCEDB9CFEA05DDEDE738B758AD6AABAACC01114580EF6EF7B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="643563" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409
                                                                                                                                                                                                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                      File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1835008
                                                                                                                                                                                                                      Entropy (8bit):4.416647753213595
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:Ncifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNF5+:ai58oSWIZBk2MM6AFB/o
                                                                                                                                                                                                                      MD5:65FBF61A49D79B5BD10B07C8349E1AA5
                                                                                                                                                                                                                      SHA1:D973A06DD825966F70F3072ACD4EDBCBEE492D36
                                                                                                                                                                                                                      SHA-256:3C41E7FBF1AA2F1BF9FFF34E82D195BB60B9C11F2F5C741EB507BC044073E5B8
                                                                                                                                                                                                                      SHA-512:56D100D085CF357D01608211A0227EC78D6E9BEBB40D3DCC8A9FC0338D3959BDF9173763A9FE11B3C64CC096AC75FC9BBE7E05A0CB28772154FEBAD71EF8F061
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                      Preview:regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.zRd.U..............................................................................................................................................................................................................................................................................................................................................d.EP........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Entropy (8bit):7.368391763288867
                                                                                                                                                                                                                      TrID:
                                                                                                                                                                                                                      • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                      • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                      File name:OGBLsboKIF.exe
                                                                                                                                                                                                                      File size:299'008 bytes
                                                                                                                                                                                                                      MD5:7cf2bae5bc432cbb1ce1e2e203a7784b
                                                                                                                                                                                                                      SHA1:1c78c832e0530ac569fb79d529a88944c6396dc7
                                                                                                                                                                                                                      SHA256:04c01bc45909f870c2683ac03de56386b5034a9edd4d28253fe8b243e63ba5c4
                                                                                                                                                                                                                      SHA512:c3912ef6896572c40cd77fb70b784d6f69d6428a594b72c2668fff5676ac5803b2e8387c6327b5fbe8bd2ae839b056a26005cc4b52bf50e194a7e7c7e1a732fa
                                                                                                                                                                                                                      SSDEEP:6144:DvJmITZx0RSJ7qNIBl1DSDR9H56MU3Xb:bJmITj0c3P12DR9Qb
                                                                                                                                                                                                                      TLSH:4E54F1213AA0DA72C45754708934CBB5AF7F783212A5C94737A64B7E4F702D29B3B34A
                                                                                                                                                                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........'...I...I...I.......I.......I.....".I..d2...I...H...I.......I.......I.......I.Rich..I.................PE..L.....,f...........
                                                                                                                                                                                                                      Icon Hash:63796de971636e0f
                                                                                                                                                                                                                      Entrypoint:0x404b3a
                                                                                                                                                                                                                      Entrypoint Section:.text
                                                                                                                                                                                                                      Digitally signed:false
                                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                                      Subsystem:windows gui
                                                                                                                                                                                                                      Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                                                                                      DLL Characteristics:NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                      Time Stamp:0x662C0BB2 [Fri Apr 26 20:16:50 2024 UTC]
                                                                                                                                                                                                                      TLS Callbacks:
                                                                                                                                                                                                                      CLR (.Net) Version:
                                                                                                                                                                                                                      OS Version Major:5
                                                                                                                                                                                                                      OS Version Minor:0
                                                                                                                                                                                                                      File Version Major:5
                                                                                                                                                                                                                      File Version Minor:0
                                                                                                                                                                                                                      Subsystem Version Major:5
                                                                                                                                                                                                                      Subsystem Version Minor:0
                                                                                                                                                                                                                      Import Hash:321f975ee8f8e533eb0cddbd63fede6f
                                                                                                                                                                                                                      Instruction
                                                                                                                                                                                                                      call 00007F8F4C912CFFh
                                                                                                                                                                                                                      jmp 00007F8F4C90E37Dh
                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                      call 00007F8F4C90E53Ch
                                                                                                                                                                                                                      xchg cl, ch
                                                                                                                                                                                                                      jmp 00007F8F4C90E524h
                                                                                                                                                                                                                      call 00007F8F4C90E533h
                                                                                                                                                                                                                      fxch st(0), st(1)
                                                                                                                                                                                                                      jmp 00007F8F4C90E51Bh
                                                                                                                                                                                                                      fabs
                                                                                                                                                                                                                      fld1
                                                                                                                                                                                                                      mov ch, cl
                                                                                                                                                                                                                      xor cl, cl
                                                                                                                                                                                                                      jmp 00007F8F4C90E511h
                                                                                                                                                                                                                      mov byte ptr [ebp-00000090h], FFFFFFFEh
                                                                                                                                                                                                                      fabs
                                                                                                                                                                                                                      fxch st(0), st(1)
                                                                                                                                                                                                                      fabs
                                                                                                                                                                                                                      fxch st(0), st(1)
                                                                                                                                                                                                                      fpatan
                                                                                                                                                                                                                      or cl, cl
                                                                                                                                                                                                                      je 00007F8F4C90E506h
                                                                                                                                                                                                                      fldpi
                                                                                                                                                                                                                      fsubrp st(1), st(0)
                                                                                                                                                                                                                      or ch, ch
                                                                                                                                                                                                                      je 00007F8F4C90E504h
                                                                                                                                                                                                                      fchs
                                                                                                                                                                                                                      ret
                                                                                                                                                                                                                      fabs
                                                                                                                                                                                                                      fld st(0), st(0)
                                                                                                                                                                                                                      fld st(0), st(0)
                                                                                                                                                                                                                      fld1
                                                                                                                                                                                                                      fsubrp st(1), st(0)
                                                                                                                                                                                                                      fxch st(0), st(1)
                                                                                                                                                                                                                      fld1
                                                                                                                                                                                                                      faddp st(1), st(0)
                                                                                                                                                                                                                      fmulp st(1), st(0)
                                                                                                                                                                                                                      ftst
                                                                                                                                                                                                                      wait
                                                                                                                                                                                                                      fstsw word ptr [ebp-000000A0h]
                                                                                                                                                                                                                      wait
                                                                                                                                                                                                                      test byte ptr [ebp-0000009Fh], 00000001h
                                                                                                                                                                                                                      jne 00007F8F4C90E507h
                                                                                                                                                                                                                      xor ch, ch
                                                                                                                                                                                                                      fsqrt
                                                                                                                                                                                                                      ret
                                                                                                                                                                                                                      pop eax
                                                                                                                                                                                                                      jmp 00007F8F4C912EBFh
                                                                                                                                                                                                                      fstp st(0)
                                                                                                                                                                                                                      fld tbyte ptr [0044069Ah]
                                                                                                                                                                                                                      ret
                                                                                                                                                                                                                      fstp st(0)
                                                                                                                                                                                                                      or cl, cl
                                                                                                                                                                                                                      je 00007F8F4C90E50Dh
                                                                                                                                                                                                                      fstp st(0)
                                                                                                                                                                                                                      fldpi
                                                                                                                                                                                                                      or ch, ch
                                                                                                                                                                                                                      je 00007F8F4C90E504h
                                                                                                                                                                                                                      fchs
                                                                                                                                                                                                                      ret
                                                                                                                                                                                                                      fstp st(0)
                                                                                                                                                                                                                      fldz
                                                                                                                                                                                                                      or ch, ch
                                                                                                                                                                                                                      je 00007F8F4C90E4F9h
                                                                                                                                                                                                                      fchs
                                                                                                                                                                                                                      ret
                                                                                                                                                                                                                      fstp st(0)
                                                                                                                                                                                                                      jmp 00007F8F4C912E95h
                                                                                                                                                                                                                      fstp st(0)
                                                                                                                                                                                                                      mov cl, ch
                                                                                                                                                                                                                      jmp 00007F8F4C90E502h
                                                                                                                                                                                                                      call 00007F8F4C90E4CEh
                                                                                                                                                                                                                      jmp 00007F8F4C912EA0h
                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                      push ebp
                                                                                                                                                                                                                      Programming Language:
                                                                                                                                                                                                                      • [C++] VS2008 build 21022
                                                                                                                                                                                                                      • [ASM] VS2008 build 21022
                                                                                                                                                                                                                      • [ C ] VS2008 build 21022
                                                                                                                                                                                                                      • [IMP] VS2005 build 50727
                                                                                                                                                                                                                      • [RES] VS2008 build 21022
                                                                                                                                                                                                                      • [LNK] VS2008 build 21022
                                                                                                                                                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x3f5dc0x50.text
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x4b0000x3a08.rsrc
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x2e980x40.text
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x10000x190.text
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                                                                                                                                                                                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                      .text0x10000x3ef1a0x3f000c4d01b7d4ac2ba83ae3b7000bb85ce17False0.8678269159226191data7.789421285359389IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                      .data0x400000xaba80x600089e9de83cac8fcfcf1c965507704fc04False0.08052571614583333Matlab v4 mat-file (little endian) n2, rows 2, columns 00.9646410865424075IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                      .rsrc0x4b0000xaa080x3c005dd8d8f013e5daf1cb058f62224a6cf3False0.4342447916666667data3.8734951326857514IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                      RT_ICON0x4b1e00x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 0RomanianRomania0.5368663594470046
                                                                                                                                                                                                                      RT_ICON0x4b8a80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0RomanianRomania0.41234439834024894
                                                                                                                                                                                                                      RT_ICON0x4de500x468Device independent bitmap graphic, 16 x 32 x 32, image size 0RomanianRomania0.44858156028368795
                                                                                                                                                                                                                      RT_STRING0x4e5700x496dataRomanianRomania0.444633730834753
                                                                                                                                                                                                                      RT_ACCELERATOR0x4e2e80x50dataRomanianRomania0.825
                                                                                                                                                                                                                      RT_GROUP_ICON0x4e2b80x30dataRomanianRomania0.9375
                                                                                                                                                                                                                      RT_VERSION0x4e3380x238data0.5246478873239436
                                                                                                                                                                                                                      DLLImport
                                                                                                                                                                                                                      KERNEL32.dllWriteConsoleInputW, SetComputerNameExA, EnumCalendarInfoW, InterlockedDecrement, GetCurrentProcess, InterlockedCompareExchange, GetModuleHandleW, EnumCalendarInfoExW, GetWindowsDirectoryA, EnumTimeFormatsW, ReadConsoleInputA, CopyFileW, GetConsoleAliasExesLengthW, VerifyVersionInfoA, FindNextVolumeMountPointW, GetShortPathNameA, LCMapStringA, GetLogicalDriveStringsA, GetLastError, GetCurrentDirectoryW, SetLastError, GetProcAddress, VirtualAlloc, GetAtomNameA, LoadLibraryA, CreateSemaphoreW, InterlockedExchangeAdd, OpenEventA, GetCommMask, GlobalUnWire, FreeEnvironmentStringsW, EnumDateFormatsW, SetCalendarInfoA, GetVersionExA, TerminateJobObject, GetCurrentProcessId, CreateFileA, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCommandLineA, GetStartupInfoA, TerminateProcess, IsDebuggerPresent, HeapAlloc, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, GetCurrentThreadId, Sleep, HeapSize, ExitProcess, MultiByteToWideChar, ReadFile, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, GetStdHandle, GetFileType, DeleteCriticalSection, HeapFree, WriteFile, GetModuleFileNameA, SetFilePointer, CloseHandle, FreeEnvironmentStringsA, GetEnvironmentStrings, WideCharToMultiByte, GetEnvironmentStringsW, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, RaiseException, HeapReAlloc, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, InitializeCriticalSectionAndSpinCount, RtlUnwind, SetStdHandle, GetConsoleCP, GetConsoleMode, FlushFileBuffers, GetModuleHandleA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW
                                                                                                                                                                                                                      ole32.dllCoSuspendClassObjects
                                                                                                                                                                                                                      WINHTTP.dllWinHttpCheckPlatform
                                                                                                                                                                                                                      Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                      RomanianRomania
                                                                                                                                                                                                                      TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                                                                                      2024-12-23T08:00:41.684022+01002058358ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat)1192.168.2.7559631.1.1.153UDP
                                                                                                                                                                                                                      2024-12-23T08:00:41.913898+01002058364ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)1192.168.2.7583051.1.1.153UDP
                                                                                                                                                                                                                      2024-12-23T08:00:42.294168+01002058360ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)1192.168.2.7626571.1.1.153UDP
                                                                                                                                                                                                                      2024-12-23T08:00:42.977123+01002058370ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat)1192.168.2.7569821.1.1.153UDP
                                                                                                                                                                                                                      2024-12-23T08:00:43.238847+01002058362ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat)1192.168.2.7532151.1.1.153UDP
                                                                                                                                                                                                                      2024-12-23T08:00:43.469673+01002058354ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)1192.168.2.7510451.1.1.153UDP
                                                                                                                                                                                                                      2024-12-23T08:00:43.691893+01002058376ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat)1192.168.2.7503371.1.1.153UDP
                                                                                                                                                                                                                      2024-12-23T08:00:43.915628+01002058374ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat)1192.168.2.7623551.1.1.153UDP
                                                                                                                                                                                                                      2024-12-23T08:00:45.677128+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.74969923.55.153.106443TCP
                                                                                                                                                                                                                      2024-12-23T08:00:46.427761+01002858666ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup1192.168.2.74969923.55.153.106443TCP
                                                                                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                      Dec 23, 2024 08:00:44.279875040 CET49699443192.168.2.723.55.153.106
                                                                                                                                                                                                                      Dec 23, 2024 08:00:44.279918909 CET4434969923.55.153.106192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:44.279987097 CET49699443192.168.2.723.55.153.106
                                                                                                                                                                                                                      Dec 23, 2024 08:00:44.283205032 CET49699443192.168.2.723.55.153.106
                                                                                                                                                                                                                      Dec 23, 2024 08:00:44.283215046 CET4434969923.55.153.106192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:45.676947117 CET4434969923.55.153.106192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:45.677128077 CET49699443192.168.2.723.55.153.106
                                                                                                                                                                                                                      Dec 23, 2024 08:00:45.691644907 CET49699443192.168.2.723.55.153.106
                                                                                                                                                                                                                      Dec 23, 2024 08:00:45.691664934 CET4434969923.55.153.106192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:45.692013025 CET4434969923.55.153.106192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:45.735586882 CET49699443192.168.2.723.55.153.106
                                                                                                                                                                                                                      Dec 23, 2024 08:00:45.746982098 CET49699443192.168.2.723.55.153.106
                                                                                                                                                                                                                      Dec 23, 2024 08:00:45.787338972 CET4434969923.55.153.106192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:46.427807093 CET4434969923.55.153.106192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:46.427838087 CET4434969923.55.153.106192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:46.427866936 CET4434969923.55.153.106192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:46.427882910 CET4434969923.55.153.106192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:46.427905083 CET4434969923.55.153.106192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:46.427913904 CET49699443192.168.2.723.55.153.106
                                                                                                                                                                                                                      Dec 23, 2024 08:00:46.427922964 CET4434969923.55.153.106192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:46.427977085 CET49699443192.168.2.723.55.153.106
                                                                                                                                                                                                                      Dec 23, 2024 08:00:46.611768007 CET4434969923.55.153.106192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:46.611818075 CET4434969923.55.153.106192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:46.611845970 CET4434969923.55.153.106192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:46.611892939 CET49699443192.168.2.723.55.153.106
                                                                                                                                                                                                                      Dec 23, 2024 08:00:46.611906052 CET4434969923.55.153.106192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:46.611922979 CET4434969923.55.153.106192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:46.611952066 CET49699443192.168.2.723.55.153.106
                                                                                                                                                                                                                      Dec 23, 2024 08:00:46.614509106 CET49699443192.168.2.723.55.153.106
                                                                                                                                                                                                                      Dec 23, 2024 08:00:46.709212065 CET49699443192.168.2.723.55.153.106
                                                                                                                                                                                                                      Dec 23, 2024 08:00:46.709247112 CET4434969923.55.153.106192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:46.709266901 CET49699443192.168.2.723.55.153.106
                                                                                                                                                                                                                      Dec 23, 2024 08:00:46.709273100 CET4434969923.55.153.106192.168.2.7
                                                                                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                      Dec 23, 2024 08:00:41.684021950 CET5596353192.168.2.71.1.1.1
                                                                                                                                                                                                                      Dec 23, 2024 08:00:41.908261061 CET53559631.1.1.1192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:41.913897991 CET5830553192.168.2.71.1.1.1
                                                                                                                                                                                                                      Dec 23, 2024 08:00:42.219934940 CET53583051.1.1.1192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:42.294167995 CET6265753192.168.2.71.1.1.1
                                                                                                                                                                                                                      Dec 23, 2024 08:00:42.775399923 CET53626571.1.1.1192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:42.977123022 CET5698253192.168.2.71.1.1.1
                                                                                                                                                                                                                      Dec 23, 2024 08:00:43.196304083 CET53569821.1.1.1192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:43.238847017 CET5321553192.168.2.71.1.1.1
                                                                                                                                                                                                                      Dec 23, 2024 08:00:43.467900038 CET53532151.1.1.1192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:43.469672918 CET5104553192.168.2.71.1.1.1
                                                                                                                                                                                                                      Dec 23, 2024 08:00:43.689785004 CET53510451.1.1.1192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:43.691893101 CET5033753192.168.2.71.1.1.1
                                                                                                                                                                                                                      Dec 23, 2024 08:00:43.909725904 CET53503371.1.1.1192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:43.915627956 CET6235553192.168.2.71.1.1.1
                                                                                                                                                                                                                      Dec 23, 2024 08:00:44.134489059 CET53623551.1.1.1192.168.2.7
                                                                                                                                                                                                                      Dec 23, 2024 08:00:44.136626005 CET5393453192.168.2.71.1.1.1
                                                                                                                                                                                                                      Dec 23, 2024 08:00:44.273471117 CET53539341.1.1.1192.168.2.7
                                                                                                                                                                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                      Dec 23, 2024 08:00:41.684021950 CET192.168.2.71.1.1.10x3042Standard query (0)crosshuaht.latA (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Dec 23, 2024 08:00:41.913897991 CET192.168.2.71.1.1.10x6aaeStandard query (0)grannyejh.latA (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Dec 23, 2024 08:00:42.294167995 CET192.168.2.71.1.1.10x8e63Standard query (0)discokeyus.latA (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Dec 23, 2024 08:00:42.977123022 CET192.168.2.71.1.1.10x3dc0Standard query (0)necklacebudi.latA (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Dec 23, 2024 08:00:43.238847017 CET192.168.2.71.1.1.10xdf65Standard query (0)energyaffai.latA (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Dec 23, 2024 08:00:43.469672918 CET192.168.2.71.1.1.10xa22eStandard query (0)aspecteirs.latA (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Dec 23, 2024 08:00:43.691893101 CET192.168.2.71.1.1.10x54ddStandard query (0)sustainskelet.latA (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Dec 23, 2024 08:00:43.915627956 CET192.168.2.71.1.1.10xdadStandard query (0)rapeflowwj.latA (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Dec 23, 2024 08:00:44.136626005 CET192.168.2.71.1.1.10x3aadStandard query (0)steamcommunity.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                      Dec 23, 2024 08:00:41.908261061 CET1.1.1.1192.168.2.70x3042Name error (3)crosshuaht.latnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Dec 23, 2024 08:00:42.219934940 CET1.1.1.1192.168.2.70x6aaeName error (3)grannyejh.latnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Dec 23, 2024 08:00:42.775399923 CET1.1.1.1192.168.2.70x8e63Name error (3)discokeyus.latnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Dec 23, 2024 08:00:43.196304083 CET1.1.1.1192.168.2.70x3dc0Name error (3)necklacebudi.latnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Dec 23, 2024 08:00:43.467900038 CET1.1.1.1192.168.2.70xdf65Name error (3)energyaffai.latnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Dec 23, 2024 08:00:43.689785004 CET1.1.1.1192.168.2.70xa22eName error (3)aspecteirs.latnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Dec 23, 2024 08:00:43.909725904 CET1.1.1.1192.168.2.70x54ddName error (3)sustainskelet.latnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Dec 23, 2024 08:00:44.134489059 CET1.1.1.1192.168.2.70xdadName error (3)rapeflowwj.latnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Dec 23, 2024 08:00:44.273471117 CET1.1.1.1192.168.2.70x3aadNo error (0)steamcommunity.com23.55.153.106A (IP address)IN (0x0001)false
                                                                                                                                                                                                                      • steamcommunity.com
                                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                      0192.168.2.74969923.55.153.1064433564C:\Users\user\Desktop\OGBLsboKIF.exe
                                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                                      2024-12-23 07:00:45 UTC219OUTGET /profiles/76561199724331900 HTTP/1.1
                                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                      Host: steamcommunity.com
                                                                                                                                                                                                                      2024-12-23 07:00:46 UTC1905INHTTP/1.1 200 OK
                                                                                                                                                                                                                      Server: nginx
                                                                                                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                      Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED]
                                                                                                                                                                                                                      Expires: Mon, 26 Jul 1997 05:00:00 GMT
                                                                                                                                                                                                                      Cache-Control: no-cache
                                                                                                                                                                                                                      Date: Mon, 23 Dec 2024 07:00:46 GMT
                                                                                                                                                                                                                      Content-Length: 25665
                                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                                      Set-Cookie: sessionid=57a979f2c82b2474b8b734c3; Path=/; Secure; SameSite=None
                                                                                                                                                                                                                      Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
                                                                                                                                                                                                                      2024-12-23 07:00:46 UTC14479INData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e
                                                                                                                                                                                                                      Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
                                                                                                                                                                                                                      2024-12-23 07:00:46 UTC10097INData Raw: 3f 6c 3d 6b 6f 72 65 61 6e 61 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 6b 6f 72 65 61 6e 61 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e ed 95 9c ea b5 ad ec 96 b4 20 28 4b 6f 72 65 61 6e 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 74 68 61 69 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 68 61 69 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e0 b9 84 e0 b8 97 e0 b8 a2 20 28 54 68 61 69 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09
                                                                                                                                                                                                                      Data Ascii: ?l=koreana" onclick="ChangeLanguage( 'koreana' ); return false;"> (Korean)</a><a class="popup_menu_item tight" href="?l=thai" onclick="ChangeLanguage( 'thai' ); return false;"> (Thai)</a>
                                                                                                                                                                                                                      2024-12-23 07:00:46 UTC1089INData Raw: 68 65 69 72 20 72 65 73 70 65 63 74 69 76 65 20 6f 77 6e 65 72 73 20 69 6e 20 74 68 65 20 55 53 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 75 6e 74 72 69 65 73 2e 3c 62 72 2f 3e 53 6f 6d 65 20 67 65 6f 73 70 61 74 69 61 6c 20 64 61 74 61 20 6f 6e 20 74 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 72 6f 76 69 64 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 6c 69 6e 6b 66 69 6c 74 65 72 2f 3f 75 3d 68 74 74 70 25 33 41 25 32 46 25 32 46 77 77 77 2e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 20 6e 6f 6f 70 65 6e 65 72 22 3e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 3c 2f 61 3e 2e 09 09 09 09 09 3c 62 72 3e 0a 09 09 09 09 09
                                                                                                                                                                                                                      Data Ascii: heir respective owners in the US and other countries.<br/>Some geospatial data on this website is provided by <a href="https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org" target="_blank" rel=" noopener">geonames.org</a>.<br>


                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                      Target ID:4
                                                                                                                                                                                                                      Start time:02:00:39
                                                                                                                                                                                                                      Start date:23/12/2024
                                                                                                                                                                                                                      Path:C:\Users\user\Desktop\OGBLsboKIF.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:"C:\Users\user\Desktop\OGBLsboKIF.exe"
                                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                                      File size:299'008 bytes
                                                                                                                                                                                                                      MD5 hash:7CF2BAE5BC432CBB1CE1E2E203A7784B
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                                                      • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000004.00000002.1616248891.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                      • Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      Target ID:10
                                                                                                                                                                                                                      Start time:02:00:46
                                                                                                                                                                                                                      Start date:23/12/2024
                                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 1672
                                                                                                                                                                                                                      Imagebase:0x2b0000
                                                                                                                                                                                                                      File size:483'680 bytes
                                                                                                                                                                                                                      MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      Reset < >

                                                                                                                                                                                                                        Execution Graph

                                                                                                                                                                                                                        Execution Coverage:1.4%
                                                                                                                                                                                                                        Dynamic/Decrypted Code Coverage:36.7%
                                                                                                                                                                                                                        Signature Coverage:38%
                                                                                                                                                                                                                        Total number of Nodes:79
                                                                                                                                                                                                                        Total number of Limit Nodes:6
                                                                                                                                                                                                                        execution_graph 26008 43aa80 26011 43d810 26008->26011 26010 43aa8a RtlAllocateHeap 26012 43d830 26011->26012 26012->26010 26012->26012 26013 43aaa0 26014 43aab3 26013->26014 26015 43aac4 26013->26015 26016 43aab8 RtlFreeHeap 26014->26016 26016->26015 26017 43c767 26018 43c790 26017->26018 26019 43c80e 26018->26019 26021 43c1f0 LdrInitializeThunk 26018->26021 26021->26019 26022 43cce6 26023 43cd00 26022->26023 26025 43cd6e 26023->26025 26029 43c1f0 LdrInitializeThunk 26023->26029 26028 43c1f0 LdrInitializeThunk 26025->26028 26027 43ce4d 26028->26027 26029->26025 26030 2080000 26033 2080006 26030->26033 26034 2080015 26033->26034 26037 20807a6 26034->26037 26038 20807c1 26037->26038 26039 20807ca CreateToolhelp32Snapshot 26038->26039 26040 20807e6 Module32First 26038->26040 26039->26038 26039->26040 26041 2080005 26040->26041 26042 20807f5 26040->26042 26044 2080465 26042->26044 26045 2080490 26044->26045 26046 20804d9 26045->26046 26047 20804a1 VirtualAlloc 26045->26047 26046->26046 26047->26046 26048 43c58a 26050 43c460 26048->26050 26049 43c5f4 26050->26049 26053 43c1f0 LdrInitializeThunk 26050->26053 26052 43c54d 26053->26052 26054 43c2c8 26055 43c2e0 26054->26055 26055->26055 26056 43ccaf GetForegroundWindow 26055->26056 26057 43ccbe 26056->26057 26058 408850 26060 40885f 26058->26060 26059 408acf ExitProcess 26060->26059 26061 408ab8 26060->26061 26062 40891c GetCurrentProcessId GetCurrentThreadId 26060->26062 26071 43c160 FreeLibrary 26061->26071 26063 408941 26062->26063 26064 408945 SHGetSpecialFolderPathW GetForegroundWindow 26062->26064 26063->26064 26066 408a3d 26064->26066 26066->26061 26070 40c550 CoInitializeEx 26066->26070 26071->26059 26072 43e7d0 26074 43e800 26072->26074 26073 43e94e 26076 43e87f 26074->26076 26078 43c1f0 LdrInitializeThunk 26074->26078 26076->26073 26079 43c1f0 LdrInitializeThunk 26076->26079 26078->26076 26079->26073 26080 20b003c 26081 20b0049 26080->26081 26095 20b0e0f SetErrorMode SetErrorMode 26081->26095 26086 20b0265 26087 20b02ce VirtualProtect 26086->26087 26089 20b030b 26087->26089 26088 20b0439 VirtualFree 26093 20b04be 26088->26093 26094 20b05f4 LoadLibraryA 26088->26094 26089->26088 26090 20b04e3 LoadLibraryA 26090->26093 26092 20b08c7 26093->26090 26093->26094 26094->26092 26096 20b0223 26095->26096 26097 20b0d90 26096->26097 26098 20b0dad 26097->26098 26099 20b0dbb GetPEB 26098->26099 26100 20b0238 VirtualAlloc 26098->26100 26099->26100 26100->26086 26106 40a03d 26107 40a130 26106->26107 26107->26107 26110 40acf0 26107->26110 26109 40a17f 26111 40ad80 26110->26111 26112 40ada5 26111->26112 26114 43c180 RtlAllocateHeap RtlFreeHeap 26111->26114 26112->26109 26114->26111

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 84 40acf0-40ad78 85 40ad80-40ad89 84->85 85->85 86 40ad8b-40ad9e 85->86 88 40b012-40b019 86->88 89 40ada5-40ada7 86->89 90 40b0e7-40b0f0 86->90 91 40b0f7-40b0fd 86->91 92 40adac-40afc7 86->92 93 40b09d-40b0b7 86->93 94 40b01e-40b096 call 407f00 86->94 95 40b0ff-40b10a 86->95 98 40b367-40b373 88->98 102 40b351-40b358 89->102 90->91 90->95 100 40b359-40b364 90->100 101 40b0be-40b0e2 call 43dbf0 90->101 104 40b341-40b344 90->104 105 40b1c4-40b1d1 90->105 106 40b268-40b289 call 43dbf0 90->106 107 40b1eb-40b20b 90->107 108 40b22b-40b235 90->108 109 40b330 90->109 110 40b212-40b224 90->110 111 40b332-40b335 90->111 112 40b295-40b2b4 90->112 113 40b2f5-40b31b 90->113 114 40b375 90->114 115 40b2d6-40b2ee call 43c180 90->115 116 40b256-40b263 90->116 117 40b1d8-40b1df 90->117 118 40b33c 90->118 119 40b23c-40b254 call 43dbf0 90->119 120 40b37c 90->120 121 40b31d 90->121 96 40b141-40b164 91->96 103 40afd0-40aff2 92->103 93->100 93->101 94->90 94->91 94->93 94->95 94->100 94->101 94->104 94->105 94->106 94->107 94->108 94->109 94->110 94->111 94->112 94->113 94->114 94->115 94->116 94->117 94->118 94->119 94->120 94->121 97 40b110-40b13a 95->97 130 40b170-40b1a1 96->130 97->97 129 40b13c-40b13f 97->129 98->102 100->98 101->100 103->103 126 40aff4-40afff 103->126 142 40b34b 104->142 105->100 105->101 105->106 105->114 105->117 105->120 106->112 107->100 107->101 107->104 107->106 107->108 107->109 107->110 107->111 107->112 107->113 107->114 107->115 107->116 107->117 107->118 107->119 107->120 107->121 108->100 108->101 108->106 108->114 108->116 108->117 108->119 108->120 110->100 110->101 110->104 110->106 110->108 110->109 110->111 110->112 110->113 110->114 110->115 110->116 110->117 110->118 110->119 110->120 110->121 111->100 111->101 111->104 111->106 111->114 111->116 111->117 111->118 111->119 111->120 137 40b2bd-40b2cf 112->137 125 40b322-40b328 113->125 114->120 115->100 115->101 115->104 115->106 115->109 115->111 115->113 115->114 115->116 115->117 115->118 115->119 115->120 115->121 116->104 117->107 118->104 119->116 134 40b383 120->134 121->125 125->109 143 40b002-40b00b 126->143 129->96 130->130 139 40b1a3-40b1bd 130->139 134->134 137->100 137->101 137->104 137->106 137->109 137->111 137->113 137->114 137->115 137->116 137->117 137->118 137->119 137->120 137->121 139->100 139->101 139->104 139->105 139->106 139->107 139->108 139->109 139->110 139->111 139->112 139->113 139->114 139->115 139->116 139->117 139->118 139->119 139->120 139->121 142->102 143->88 143->90 143->91 143->93 143->94 143->95 143->100 143->101 143->104 143->105 143->106 143->107 143->108 143->109 143->110 143->111 143->112 143->113 143->114 143->115 143->116 143->117 143->118 143->119 143->120 143->121
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: &K M$&wXy$'sZu$/O_q$Jk"m$e7o9$h? !
                                                                                                                                                                                                                        • API String ID: 0-2986092683
                                                                                                                                                                                                                        • Opcode ID: 78924bc98445a2391149b9471296c65ab5c3f104a6a24834f995a4e0cdf96e1e
                                                                                                                                                                                                                        • Instruction ID: 590b8efa2b06f5e02b6b835ab0c7a13339e1eb4ce69d4453d365afcab8c45654
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 78924bc98445a2391149b9471296c65ab5c3f104a6a24834f995a4e0cdf96e1e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D80286B5200B01DFD324CF25D891B97BBF1FB49705F108A2CE5AA8BAA0D775A845CF85

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 149 408850-408861 call 43bc60 152 408867-40888f call 408020 149->152 153 408acf-408ad1 ExitProcess 149->153 156 408890-4088cb 152->156 157 408904-408916 call 4354e0 156->157 158 4088cd-408902 156->158 161 408ab8-408abf 157->161 162 40891c-40893f GetCurrentProcessId GetCurrentThreadId 157->162 158->156 163 408ac1-408ac7 call 408030 161->163 164 408aca call 43c160 161->164 165 408941-408943 162->165 166 408945-408a3b SHGetSpecialFolderPathW GetForegroundWindow 162->166 163->164 164->153 165->166 167 408a6b-408aa2 call 409b00 166->167 168 408a3d-408a69 166->168 173 408aa7-408aac 167->173 168->167 173->161 174 408aae-408ab3 call 40c550 call 40b390 173->174 174->161
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32 ref: 0040891C
                                                                                                                                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 00408925
                                                                                                                                                                                                                        • SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 004089DB
                                                                                                                                                                                                                        • GetForegroundWindow.USER32 ref: 00408A33
                                                                                                                                                                                                                          • Part of subcall function 0040C550: CoInitializeEx.OLE32(00000000,00000002), ref: 0040C563
                                                                                                                                                                                                                          • Part of subcall function 0040B390: FreeLibrary.KERNEL32(00408AB8), ref: 0040B396
                                                                                                                                                                                                                          • Part of subcall function 0040B390: FreeLibrary.KERNEL32 ref: 0040B3B7
                                                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 00408AD1
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CurrentFreeLibraryProcess$ExitFolderForegroundInitializePathSpecialThreadWindow
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3072701918-0
                                                                                                                                                                                                                        • Opcode ID: 80d43e03976d674c32d86d2947b6f6748d05092d2929b392bf544b78baad5a14
                                                                                                                                                                                                                        • Instruction ID: 4e8ceca9db94e69365d2c2d7f1aefafb9de861df3649afd20bfce81a3928f3be
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 80d43e03976d674c32d86d2947b6f6748d05092d2929b392bf544b78baad5a14
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9351A9BBF102180BD71CAEAACD463A675878BC5710F1F813E5985EB7D6EDB88C0142C9

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 189 20807a6-20807bf 190 20807c1-20807c3 189->190 191 20807ca-20807d6 CreateToolhelp32Snapshot 190->191 192 20807c5 190->192 193 20807d8-20807de 191->193 194 20807e6-20807f3 Module32First 191->194 192->191 193->194 199 20807e0-20807e4 193->199 195 20807fc-2080804 194->195 196 20807f5-20807f6 call 2080465 194->196 200 20807fb 196->200 199->190 199->194 200->195
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 020807CE
                                                                                                                                                                                                                        • Module32First.KERNEL32(00000000,00000224), ref: 020807EE
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616248891.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_2080000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CreateFirstModule32SnapshotToolhelp32
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3833638111-0
                                                                                                                                                                                                                        • Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
                                                                                                                                                                                                                        • Instruction ID: 0a101678ac717b837d0ae6530fd11349ab85ed16e94684e61c163ba6d33a6aab
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 38F096315017116FE7213BF5D88CB6F76E9AF49A65F100568E683910C0DB70E8495E61

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 211 43c1f0-43c222 LdrInitializeThunk
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • LdrInitializeThunk.NTDLL(0043E31B,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043C21E
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InitializeThunk
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2994545307-0
                                                                                                                                                                                                                        • Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
                                                                                                                                                                                                                        • Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: ,+*)
                                                                                                                                                                                                                        • API String ID: 0-3529585375
                                                                                                                                                                                                                        • Opcode ID: e7fb2fe7fc15d814734d125e3abc6185c50616f6403d63d9b463f0ac7ddf630e
                                                                                                                                                                                                                        • Instruction ID: 95b520c28a51d7a8debe208fb8c6725e065a55489a7142fefcc330b3f2274472
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e7fb2fe7fc15d814734d125e3abc6185c50616f6403d63d9b463f0ac7ddf630e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7331A539B402119BEB18CF58CCD1BBEB7B2BB49301F249129D501B7390CB75AD018B58

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 0 20b003c-20b0047 1 20b0049 0->1 2 20b004c-20b0263 call 20b0a3f call 20b0e0f call 20b0d90 VirtualAlloc 0->2 1->2 17 20b028b-20b0292 2->17 18 20b0265-20b0289 call 20b0a69 2->18 20 20b02a1-20b02b0 17->20 21 20b02ce-20b03c2 VirtualProtect call 20b0cce call 20b0ce7 18->21 20->21 22 20b02b2-20b02cc 20->22 29 20b03d1-20b03e0 21->29 22->20 30 20b0439-20b04b8 VirtualFree 29->30 31 20b03e2-20b0437 call 20b0ce7 29->31 33 20b04be-20b04cd 30->33 34 20b05f4-20b05fe 30->34 31->29 38 20b04d3-20b04dd 33->38 35 20b077f-20b0789 34->35 36 20b0604-20b060d 34->36 41 20b078b-20b07a3 35->41 42 20b07a6-20b07b0 35->42 36->35 39 20b0613-20b0637 36->39 38->34 43 20b04e3-20b0505 LoadLibraryA 38->43 48 20b063e-20b0648 39->48 41->42 44 20b086e-20b08be LoadLibraryA 42->44 45 20b07b6-20b07cb 42->45 46 20b0517-20b0520 43->46 47 20b0507-20b0515 43->47 56 20b08c7-20b08f9 44->56 49 20b07d2-20b07d5 45->49 50 20b0526-20b0547 46->50 47->50 48->35 51 20b064e-20b065a 48->51 52 20b07d7-20b07e0 49->52 53 20b0824-20b0833 49->53 54 20b054d-20b0550 50->54 51->35 55 20b0660-20b066a 51->55 57 20b07e2 52->57 58 20b07e4-20b0822 52->58 62 20b0839-20b083c 53->62 59 20b05e0-20b05ef 54->59 60 20b0556-20b056b 54->60 61 20b067a-20b0689 55->61 63 20b08fb-20b0901 56->63 64 20b0902-20b091d 56->64 57->53 58->49 59->38 65 20b056f-20b057a 60->65 66 20b056d 60->66 67 20b068f-20b06b2 61->67 68 20b0750-20b077a 61->68 62->44 69 20b083e-20b0847 62->69 63->64 71 20b059b-20b05bb 65->71 72 20b057c-20b0599 65->72 66->59 73 20b06ef-20b06fc 67->73 74 20b06b4-20b06ed 67->74 68->48 75 20b084b-20b086c 69->75 76 20b0849 69->76 83 20b05bd-20b05db 71->83 72->83 77 20b074b 73->77 78 20b06fe-20b0748 73->78 74->73 75->62 76->44 77->61 78->77 83->54
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 020B024D
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AllocVirtual
                                                                                                                                                                                                                        • String ID: cess$kernel32.dll
                                                                                                                                                                                                                        • API String ID: 4275171209-1230238691
                                                                                                                                                                                                                        • Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
                                                                                                                                                                                                                        • Instruction ID: 14817da49ff3392f219a4229ff7d25448ff8ef163c1352c92a335c57ab03c33e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B8526974A01229DFDBA5CF68C984BADBBB1BF09304F1480D9E54DAB351DB30AA85DF14

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 202 20b0e0f-20b0e24 SetErrorMode * 2 203 20b0e2b-20b0e2c 202->203 204 20b0e26 202->204 204->203
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SetErrorMode.KERNELBASE(00000400,?,?,020B0223,?,?), ref: 020B0E19
                                                                                                                                                                                                                        • SetErrorMode.KERNELBASE(00000000,?,?,020B0223,?,?), ref: 020B0E1E
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorMode
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2340568224-0
                                                                                                                                                                                                                        • Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
                                                                                                                                                                                                                        • Instruction ID: c2860f47db282722f4f6209d79134e175963663ed1f9cd71128f4e39bb3dd98e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 53D0123514522877D7512A94DC09BCE7B5CDF05B66F008011FB0DD9080C770954046E5

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 205 43c2c8-43c2d6 206 43c2e0-43c2fd 205->206 206->206 207 43c2ff-43ccb9 GetForegroundWindow call 43e110 206->207 210 43ccbe-43ccdf 207->210
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetForegroundWindow.USER32 ref: 0043CCAF
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ForegroundWindow
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2020703349-0
                                                                                                                                                                                                                        • Opcode ID: ee62edd4f90ceb3851fb76d6bb2596050db7060e58c86fce7ad8149e0838c105
                                                                                                                                                                                                                        • Instruction ID: 8fb46afbfb550afb85baefcd5c24b2e1a72551ea741637eac68a3138d718cba2
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ee62edd4f90ceb3851fb76d6bb2596050db7060e58c86fce7ad8149e0838c105
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 07F04CBAD005408BDB044B75CC821A67BA2DB5F320B18897DD441E3384C63C5807CB5D

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 212 43aaa0-43aaac 213 43aab3-43aabe call 43d810 RtlFreeHeap 212->213 214 43aac4-43aac5 212->214 213->214
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • RtlFreeHeap.NTDLL(?,00000000,?,0043C1D6,?,0040B2E4,00000000,00000001), ref: 0043AABE
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FreeHeap
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3298025750-0
                                                                                                                                                                                                                        • Opcode ID: 6bd8f6e4c03da58ea1ddb055db28ee6a0cd2fda4e2937b11b34eec233391d5a2
                                                                                                                                                                                                                        • Instruction ID: 16971ee2c2e030bf17817a0d81dc477e65560ccac1e7abaabcdfe7fdc6775186
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6bd8f6e4c03da58ea1ddb055db28ee6a0cd2fda4e2937b11b34eec233391d5a2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B2D01231505522EBC6102F25FC06B863A58EF0E761F0748B1B4006B071C765ECA186D8

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 217 43aa80-43aa97 call 43d810 RtlAllocateHeap
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • RtlAllocateHeap.NTDLL(?,00000000,?,?,0043C1C0), ref: 0043AA90
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AllocateHeap
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1279760036-0
                                                                                                                                                                                                                        • Opcode ID: 733e1922efac4f9a0d584a8944a64cd40278d35b25fcdbd161a554f2c268bb95
                                                                                                                                                                                                                        • Instruction ID: 72b53a506d10aa35cab301047588232e26feb19e762ad2a100d4e8a4b6eb39e1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 733e1922efac4f9a0d584a8944a64cd40278d35b25fcdbd161a554f2c268bb95
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D6C09231445220BBCA143B16FC09FCA3F68EF4D762F0244A6F514670B2CB61BCA2CAD8
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 020804B6
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616248891.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_2080000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AllocVirtual
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 4275171209-0
                                                                                                                                                                                                                        • Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
                                                                                                                                                                                                                        • Instruction ID: 22c0b33adfcfe409e24bde8d3ee93e7e27180868161be3bafd6f1774acb1f693
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FA113C79A40208EFDB01DF98C985E99BBF5AF08350F058094F9889B361D771EA50EF80
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: $!$($+$,$.$/$0$0$1$1$1$1$2$3$3$4$5$5$7$7$8$9$:$;$<$<$=$>$>$?$?$?$@$@$@$B$B$D$D$D$F$J$L$L$N$P$R$T$U$V$W$X$X$Y$Z$[$[$\$]$^$_$`$`$b$b$d$f$f$g$j$o$o$q$r$r$s$u$v$v$x${$|
                                                                                                                                                                                                                        • API String ID: 0-561599860
                                                                                                                                                                                                                        • Opcode ID: 10d440d78822d09e0470b5f34489f211c766880f4e3e3e7e2fe2868a43d71886
                                                                                                                                                                                                                        • Instruction ID: f086b17abffa5a23de60675b3e35e143f4d24521fa3f36365588902221ef9ede
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 10d440d78822d09e0470b5f34489f211c766880f4e3e3e7e2fe2868a43d71886
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B013AC3150C7C08AD3359B38C4543DFBBE1ABD6314F188A6EE4E9873C2D6B989858B57
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: $!$($+$,$.$/$0$0$1$1$1$1$2$3$3$4$5$5$7$7$8$9$:$;$<$<$=$>$>$?$?$?$@$@$@$B$B$D$D$D$F$J$L$L$N$P$R$T$U$V$W$X$X$Y$Z$[$[$\$]$^$_$`$`$b$b$d$f$f$g$j$o$o$q$r$r$s$u$v$v$x${$|
                                                                                                                                                                                                                        • API String ID: 0-561599860
                                                                                                                                                                                                                        • Opcode ID: 5d0905d9e0f91c5c418c3ecbfefb3f90c6b7c7927ba12d209d8fa4479d815a2e
                                                                                                                                                                                                                        • Instruction ID: f80186d2a6faa3e649e4441cf66c686b43e71f1382a7f3e31db1e380c7509984
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5d0905d9e0f91c5c418c3ecbfefb3f90c6b7c7927ba12d209d8fa4479d815a2e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 34139A7150C7C08ED3359B38C4583AFBBE2AB96324F188A6DD8E9873D2C6798445DB53
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: -$.$0$1$4$5$:$=$@$B$D$F$G$H$J$L$N$N$P$R$T$V$X$Z$\$\$^$i$p$q$x$z${$|$~
                                                                                                                                                                                                                        • API String ID: 0-168325148
                                                                                                                                                                                                                        • Opcode ID: dffcdbe7c59816050bcb47420a350e77fe25c9c65786c839b5995c95da9d8176
                                                                                                                                                                                                                        • Instruction ID: 6b3287e7d647f6fc9aa8d330ed56109632cb450684d46cb972cc03f30992e160
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dffcdbe7c59816050bcb47420a350e77fe25c9c65786c839b5995c95da9d8176
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 15D19F2090C7D98EDB22C77C884439EBFA15B67324F1882DDD4E96B3D2C3B94946C766
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: -$.$0$1$4$5$:$=$@$B$D$F$G$H$J$L$N$N$P$R$T$V$X$Z$\$\$^$i$p$q$x$z${$|$~
                                                                                                                                                                                                                        • API String ID: 0-168325148
                                                                                                                                                                                                                        • Opcode ID: 1931f6c8ecb165f1204fd7e146898a82d55f5c0f38f6d6832a679dd5bdd43d7e
                                                                                                                                                                                                                        • Instruction ID: d4cf1bca90fb71d19e0ce753fd59c38de2216ad46b618e6125d0fb2f63368d30
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1931f6c8ecb165f1204fd7e146898a82d55f5c0f38f6d6832a679dd5bdd43d7e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8DD1A0209087D98EDB22C77C884479DBFA15F57224F0882DCD4E96B3E2D3B94946C766
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: !$*W.Y$+K!M$;[0]$>C7E$FOEH$NO$U'g)$UGBY$bweM$g#X%$l+X-$w?n!${7y9$$&$EG
                                                                                                                                                                                                                        • API String ID: 0-3492884535
                                                                                                                                                                                                                        • Opcode ID: 5e16a26193487a4bdaa5a93cbbb181080dd0d43d457804532e7adee19b2f1ec1
                                                                                                                                                                                                                        • Instruction ID: ba39798a3fcb6da663dd5afd8d89a9a5fc3f4f782173f0556435d4ff5b4d5338
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5e16a26193487a4bdaa5a93cbbb181080dd0d43d457804532e7adee19b2f1ec1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A3E10EB4608350CFD7249F25E85176FBBF2FB86304F45896DE5D88B252D7388906CB4A
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CoCreateInstance.OLE32(0044168C,00000000,00000001,0044167C,00000000), ref: 00438034
                                                                                                                                                                                                                        • SysAllocString.OLEAUT32()\"^), ref: 004380C3
                                                                                                                                                                                                                        • CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00438101
                                                                                                                                                                                                                        • SysAllocString.OLEAUT32()\"^), ref: 0043817E
                                                                                                                                                                                                                        • SysAllocString.OLEAUT32()\"^), ref: 00438238
                                                                                                                                                                                                                        • VariantInit.OLEAUT32(C7C6C5CC), ref: 004382A8
                                                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 004383F9
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(?), ref: 0043841D
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(?), ref: 00438423
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 00438430
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: String$AllocFree$Variant$BlanketClearCreateInitInstanceProxy
                                                                                                                                                                                                                        • String ID: P%R$)\"^$.H4J$O@$pq
                                                                                                                                                                                                                        • API String ID: 2485776651-1397720406
                                                                                                                                                                                                                        • Opcode ID: 99389cd6846ffddf47e3914131a3c94635c8c48cfc52d90ecef9ec7663b7e69d
                                                                                                                                                                                                                        • Instruction ID: 8d1c6a9ba2bf63fa8fe487279597ba15b590cfaf954231a8494ef46f424a72d4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 99389cd6846ffddf47e3914131a3c94635c8c48cfc52d90ecef9ec7663b7e69d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D022EFB2A483418BD314CF25C880B5BBBE5EFC9704F148A2DF5919B381E779D909CB96
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: #f!x$%y$)Z*\$)Z/\$-^+P$5F6X$6T$7$8JL$9YB$:JL$<[5]$=_%A$>N@$?z=|$A/6Q$VaUc$o#M%$pIrK$tv
                                                                                                                                                                                                                        • API String ID: 0-2608794092
                                                                                                                                                                                                                        • Opcode ID: 21657e5fc834c3ca3d925c669eca665cb77afa54e23a7c0446644a9599fb4a76
                                                                                                                                                                                                                        • Instruction ID: 95d7e76cba02f0a09582511e26c4ad00c8044fe5fc0ebc2eb1bbe37e4d815997
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 21657e5fc834c3ca3d925c669eca665cb77afa54e23a7c0446644a9599fb4a76
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3792C6B59053298BDB24CF59D8887EEBBB1FB85304F2082EDD4596B350DB744A86CF84
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: #f!x$$%$%y$)Z*\$)Z/\$-^+P$5F6X$6T$7$8JL$9YB$:JL$<[5]$=_%A$>N@$?z=|$A/6Q$VaUc$o#M%$pIrK
                                                                                                                                                                                                                        • API String ID: 0-1300133108
                                                                                                                                                                                                                        • Opcode ID: 58fd2d3b485852ad044d2fcd85ff715361975f915949706d7940c7d1c4703da1
                                                                                                                                                                                                                        • Instruction ID: f0effb65835d2d2e0694896053be4e203788fa5b6255ab66f53faa1eae535f9a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 58fd2d3b485852ad044d2fcd85ff715361975f915949706d7940c7d1c4703da1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: ED9294B5905229CBDB24CF59DC887EEBBB1FB85304F2082E9D4596B350DB744A86CF84
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: #f!x$%y$)Z*\$)Z/\$-^+P$5F6X$6T$7$8JL$9YB$:JL$<[5]$=_%A$>N@$?z=|$A/6Q$VaUc$o#M%$pIrK
                                                                                                                                                                                                                        • API String ID: 0-1893782281
                                                                                                                                                                                                                        • Opcode ID: 352bc6129ea404ee1fcf6995b34e1b15834a7e93a19395cb87ac8d1b474b4daa
                                                                                                                                                                                                                        • Instruction ID: 781679972a6841e1c847c4f60efe13a356bbdcba151b8db67255a8fcfea8ccb6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 352bc6129ea404ee1fcf6995b34e1b15834a7e93a19395cb87ac8d1b474b4daa
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8E92A6B5905229CBDB24CF59D8887EEBB71FB85304F2082EDD4596B350DB744A86CF84
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: #f!x$%y$)Z*\$)Z/\$-^+P$5F6X$6T$7$8JL$:JL$<[5]$=_%A$>N@$?z=|$A/6Q$VaUc$hi$o#M%$pIrK
                                                                                                                                                                                                                        • API String ID: 0-2118368390
                                                                                                                                                                                                                        • Opcode ID: 6369199cb7596cff2474a1e92261283ffba6f3554d101fd91b4a7e503897d434
                                                                                                                                                                                                                        • Instruction ID: dae4bbb8a642db13daffcbb2842dbd9d70f658a1d34d25660e2fd2d356b1815f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6369199cb7596cff2474a1e92261283ffba6f3554d101fd91b4a7e503897d434
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4232ECB484A3698ADBA5CF5599883CDBB71FB51304F2082D8C46D3B264DBB50BC6CF85
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CoCreateInstance.COMBASE(0044168C,00000000,00000001,0044167C,00000000), ref: 020E829B
                                                                                                                                                                                                                        • SysAllocString.OLEAUT32()\"^), ref: 020E832A
                                                                                                                                                                                                                        • CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 020E8368
                                                                                                                                                                                                                        • SysAllocString.OLEAUT32()\"^), ref: 020E83E5
                                                                                                                                                                                                                        • SysAllocString.OLEAUT32()\"^), ref: 020E849F
                                                                                                                                                                                                                        • VariantInit.OLEAUT32(C7C6C5CC), ref: 020E850F
                                                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 020E8660
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 020E8697
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: String$Alloc$Variant$BlanketClearCreateFreeInitInstanceProxy
                                                                                                                                                                                                                        • String ID: P%R$)\"^$.H4J$O@$pq
                                                                                                                                                                                                                        • API String ID: 2775254435-1397720406
                                                                                                                                                                                                                        • Opcode ID: 6b5d4364e48706977140092b86c3d080d2f37fa92fd1966bc9ba7ab4e9bc5c07
                                                                                                                                                                                                                        • Instruction ID: 69de0d3eb2b02fd10de1a1df8cda5198662d5218f81efc78926dffaf823abafe
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6b5d4364e48706977140092b86c3d080d2f37fa92fd1966bc9ba7ab4e9bc5c07
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4F22F0B2A483408FD714CF24C880BABBBE5FFC5704F148A2DE5969B290D775D945CB92
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: !+2j$"$$01;$(7.A$908#$>7;<$O35 $bblg$gn~b$ne$vm/;$w!w4
                                                                                                                                                                                                                        • API String ID: 0-1290103930
                                                                                                                                                                                                                        • Opcode ID: e76aa1fc780e58e750d1ae106741ee0e38235b05f912ede24168565961e5c466
                                                                                                                                                                                                                        • Instruction ID: 9da03d0d7728415739df837e9a5d6b3acde744231e06f1a9769003f2125b84bf
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e76aa1fc780e58e750d1ae106741ee0e38235b05f912ede24168565961e5c466
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 50A1D37120C3D18BC316CF6984A076BBFE0AF97304F484A6DE4D55B382D339890ACB56
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: !+2j$"$$01;$(7.A$908#$>7;<$O35 $bblg$gn~b$ne$vm/;$w!w4
                                                                                                                                                                                                                        • API String ID: 0-1290103930
                                                                                                                                                                                                                        • Opcode ID: e76aa1fc780e58e750d1ae106741ee0e38235b05f912ede24168565961e5c466
                                                                                                                                                                                                                        • Instruction ID: a3af4c7ae24bc3d07488251a3cb3f7f5dacdf4ba8ed20ea4b9de68e367a566cf
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e76aa1fc780e58e750d1ae106741ee0e38235b05f912ede24168565961e5c466
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 95A1E57024C3D58BC327CF7984A07ABBFE0AF97204F0849ACE5D54B252C335850ADB52
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: /G$I$7N1@$A[$Fg)i$OU$WE${\}
                                                                                                                                                                                                                        • API String ID: 0-1763234448
                                                                                                                                                                                                                        • Opcode ID: 9a3fdac08369869b3e4b907af5614077a7e06872068b7e02554c3d5f210a0157
                                                                                                                                                                                                                        • Instruction ID: 056ee81575811c50f3dd50ebd9ce003cf240713406730f881528123b83eb6744
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9a3fdac08369869b3e4b907af5614077a7e06872068b7e02554c3d5f210a0157
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2AF1CAB56083509FD3108F65E88276BBBF2FBD2345F54892DF0858B390D7B88906CB86
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: 0u4w$KT$Q$SV$_q$p8`;$qr$xy
                                                                                                                                                                                                                        • API String ID: 0-1826372655
                                                                                                                                                                                                                        • Opcode ID: de28215cb72b44d1e1dae71e7b93e978bf7f5bc1ac385d0b989c0c45dd6a48be
                                                                                                                                                                                                                        • Instruction ID: 8fe2ea29b4499c84cffcf606e05d59b8c59937f8b413fb95e2f4cb334fca5623
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: de28215cb72b44d1e1dae71e7b93e978bf7f5bc1ac385d0b989c0c45dd6a48be
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C92212B690C3109BD304DF59D8816ABB7E2EFD5314F09892DE8C98B351E739C905CB8A
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 0043C1F0: LdrInitializeThunk.NTDLL(0043E31B,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043C21E
                                                                                                                                                                                                                        • FreeLibrary.KERNEL32(?), ref: 0041A6BD
                                                                                                                                                                                                                        • FreeLibrary.KERNEL32(?), ref: 0041A77B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FreeLibrary$InitializeThunk
                                                                                                                                                                                                                        • String ID: / $/,-$46
                                                                                                                                                                                                                        • API String ID: 764372645-479303636
                                                                                                                                                                                                                        • Opcode ID: cfab914b501d8a8cf1708b7d993028f7dd60ead683b03e6467ea9e1f6c8d91ba
                                                                                                                                                                                                                        • Instruction ID: fba97bcbe2fd55ed4e85c885b06b17ae8f82464d9f69d288493d133838553020
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: cfab914b501d8a8cf1708b7d993028f7dd60ead683b03e6467ea9e1f6c8d91ba
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9EB247766493009FE3208BA5D8847ABBBD2EBC5310F18D42EE9D497311D7789C858B9B
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FreeLibrary
                                                                                                                                                                                                                        • String ID: / $/,-$46
                                                                                                                                                                                                                        • API String ID: 3664257935-479303636
                                                                                                                                                                                                                        • Opcode ID: 372519780fc120e8f753ff3a14c90593fc4e495d40ae975e42710550ded1acc0
                                                                                                                                                                                                                        • Instruction ID: c18fe836360aa2f97b83d4c00b6a9399169556b0c3e3d2cc622d44924266141b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 372519780fc120e8f753ff3a14c90593fc4e495d40ae975e42710550ded1acc0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 40B265B67483449FE3218FA5D88477FBBE3ABC5304F28C42DE9C59B211C7759845AB82
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: 8MNO$<I2K$NDNK$RXA$X$oA&C$~
                                                                                                                                                                                                                        • API String ID: 0-3328159043
                                                                                                                                                                                                                        • Opcode ID: 7d14a55b692df4f7a5a1489c3381dac725c5f5ca9d3437b0e32695eadac0db18
                                                                                                                                                                                                                        • Instruction ID: b39a018424f603aff0b8ca9a117b68807cb953dc34c5f22e55a732b949ac1150
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7d14a55b692df4f7a5a1489c3381dac725c5f5ca9d3437b0e32695eadac0db18
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 90F125B6608740CFC720CF29D8817EBB7E1AFD5314F194A2EE4D997251EB389845CB86
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: 1]_$:;$}JsE$}JsE$AC$E)G$Q?S
                                                                                                                                                                                                                        • API String ID: 0-2463461626
                                                                                                                                                                                                                        • Opcode ID: 80c25fe3e2dfb50a6448c8159146231cdcc410b8e27bdf8e1fa965ce3e3910ee
                                                                                                                                                                                                                        • Instruction ID: 1dd51b58cbaf6b0a0f55c15d87e18128fba8370b8dc8b23ccf2a832bc891c079
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 80c25fe3e2dfb50a6448c8159146231cdcc410b8e27bdf8e1fa965ce3e3910ee
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 29D1497665C3548BD324CF2488516ABBBE2EBC1304F1D897EE4D69B381D638C916CB87
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: 1]_$:;$}JsE$}JsE$AC$E)G$Q?S
                                                                                                                                                                                                                        • API String ID: 0-2463461626
                                                                                                                                                                                                                        • Opcode ID: 682ddf53b01bc525795b072e2938ffae95751b7f3a8718d374d2731849975a8c
                                                                                                                                                                                                                        • Instruction ID: 5f91162b96c1e0b9a0d2bb29e8360cc3ae1a722e76264569e8ea71e6d5a0b87b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 682ddf53b01bc525795b072e2938ffae95751b7f3a8718d374d2731849975a8c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9FD1377664C3548BC336CF6488516EFBBE2AFC1208F1D896DE4D68B341DA39C905DB42
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Clipboard$Global$CloseDataLockOpenUnlock
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1006321803-0
                                                                                                                                                                                                                        • Opcode ID: 62f3a4270cdee086724bceffc210ad3ff0b6d52f738edb6c1f0dd5dd3d126aa6
                                                                                                                                                                                                                        • Instruction ID: f2decc6a1db23371b8bb2cc1877cdad688787675f84f74fde2292b1bd35bf902
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 62f3a4270cdee086724bceffc210ad3ff0b6d52f738edb6c1f0dd5dd3d126aa6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 855102F1D08A828FD700AF78C54936EFFA0AB15310F04863ED89597392D3BCA9598797
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: ($jqci$wkw6$x|j~$ye{|$z/6q$|$Nb
                                                                                                                                                                                                                        • API String ID: 0-2309992716
                                                                                                                                                                                                                        • Opcode ID: fd7fa187f6c051c069b61ec8393945a68ebd5901bcbcecc092057dec6910dd98
                                                                                                                                                                                                                        • Instruction ID: 26eceaee55227743b306782b87e7b3b011f3ad886b5b359efa5fd428808e0ec2
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fd7fa187f6c051c069b61ec8393945a68ebd5901bcbcecc092057dec6910dd98
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F661F37164D3C68AD3118F3988A076BFFE09FA3310F18497EE4D05B382D7798A09975A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: ($jqci$wkw6$x|j~$ye{|$z/6q$|$Nb
                                                                                                                                                                                                                        • API String ID: 0-2309992716
                                                                                                                                                                                                                        • Opcode ID: fd7fa187f6c051c069b61ec8393945a68ebd5901bcbcecc092057dec6910dd98
                                                                                                                                                                                                                        • Instruction ID: 04d69d4a576e750c822d3b7e1efb9329268875212800cb0748680178a5445a1c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fd7fa187f6c051c069b61ec8393945a68ebd5901bcbcecc092057dec6910dd98
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7961286154C3C68AD3228F3988E07AAFFE0DF93614F18496DE5D14B392D369C60DEB16
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: #4<7$+8=>$PK$Tiec$\$r
                                                                                                                                                                                                                        • API String ID: 0-1906979145
                                                                                                                                                                                                                        • Opcode ID: 8a87d060594a504fb9fb2c8fb36e58836b617313b2e0b34c62a439b04e6c237f
                                                                                                                                                                                                                        • Instruction ID: 6053270823643479f5a9008bd7dab94ee1cb24749ea6a1c2bb59c6b2eb0b3cac
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8a87d060594a504fb9fb2c8fb36e58836b617313b2e0b34c62a439b04e6c237f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 29D12476A087409BD318CF35C85166BBBE2EBD1318F18893DE5E69B391D738C905CB46
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: #4<7$+8=>$PK$Tiec$\$r
                                                                                                                                                                                                                        • API String ID: 0-1906979145
                                                                                                                                                                                                                        • Opcode ID: eb9bb64c8f79c1854ab48af47ab7cc54b735788ac4fdc3cb149e9e4095002922
                                                                                                                                                                                                                        • Instruction ID: 08efe2069dab1a5ea3cd8281a8ee5266917a7d89927631cfe5e14b060dfd5077
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: eb9bb64c8f79c1854ab48af47ab7cc54b735788ac4fdc3cb149e9e4095002922
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8BD13676A083448BD729CF35C8916AFBBE2EFC1318F18892DE5D59B250D734C905CB56
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32 ref: 020B8B83
                                                                                                                                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 020B8B8C
                                                                                                                                                                                                                        • SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 020B8C42
                                                                                                                                                                                                                        • GetForegroundWindow.USER32 ref: 020B8C9A
                                                                                                                                                                                                                          • Part of subcall function 020BC7B7: CoInitializeEx.COMBASE(00000000,00000002), ref: 020BC7CA
                                                                                                                                                                                                                          • Part of subcall function 020BB5F7: FreeLibrary.KERNEL32(020B8D1F), ref: 020BB5FD
                                                                                                                                                                                                                          • Part of subcall function 020BB5F7: FreeLibrary.KERNEL32 ref: 020BB61E
                                                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 020B8D38
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CurrentFreeLibraryProcess$ExitFolderForegroundInitializePathSpecialThreadWindow
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3072701918-0
                                                                                                                                                                                                                        • Opcode ID: a98a3e3c2a5f1b0f673359f816fa1806a79807cb3814a0bc3f2413038ab882b7
                                                                                                                                                                                                                        • Instruction ID: decf6ed84fe195251e84f6f205d9639621049b2b8e14c6bd4e26d3f28a401c41
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a98a3e3c2a5f1b0f673359f816fa1806a79807cb3814a0bc3f2413038ab882b7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: ED5164B7F103180BD72CAEA98C5A7A9758B8FC5710F1E813E4945DB3E5EEB488019285
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: )G+I$+K M$B~B$|B$s0u
                                                                                                                                                                                                                        • API String ID: 0-2670551875
                                                                                                                                                                                                                        • Opcode ID: b0f283475cc496918f7695a9f64fd01b0ee276164c6e466a1bea6c055f4721cd
                                                                                                                                                                                                                        • Instruction ID: a4cd9e1bca78e5d66c5ba9b7c65c08060f0057a840f0996e05fe944024406416
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b0f283475cc496918f7695a9f64fd01b0ee276164c6e466a1bea6c055f4721cd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6C321175A08350CFD714CF28E85072EBBE2BF8A314F194A7DE89957392D7349805CB9A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: KT$Q$SV$p8`;$xy
                                                                                                                                                                                                                        • API String ID: 0-2575762000
                                                                                                                                                                                                                        • Opcode ID: 8208a9a5f85f4d31079f5f33de460df7d971af99579cab6366320c8ef0c9cde7
                                                                                                                                                                                                                        • Instruction ID: 06d586a48546632347e7732bbd98c61de60fa21b96a6c246dc8ec78f077d8826
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8208a9a5f85f4d31079f5f33de460df7d971af99579cab6366320c8ef0c9cde7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BE91FEB690C3549FD304DF56C84159FBBE2BFC5304F19896DE8C88B305EA358A099B86
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: "$-+$/$hI
                                                                                                                                                                                                                        • API String ID: 0-2772680581
                                                                                                                                                                                                                        • Opcode ID: 409baa93764c372ff58d36d41dba2cd8c3d99c0b7ed760c369768b2520c3b364
                                                                                                                                                                                                                        • Instruction ID: 80b5f3405da4d7e7bc2228bbbe7299cc3933a4313a4431d55bf3dd64750ae482
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 409baa93764c372ff58d36d41dba2cd8c3d99c0b7ed760c369768b2520c3b364
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6442387850C3818FC725CF25C8506AFBBE1AF85314F044A6EE8D85B392D739D94ACB5A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: "$-+$/$hI
                                                                                                                                                                                                                        • API String ID: 0-2772680581
                                                                                                                                                                                                                        • Opcode ID: baaf34aebe6e111159d882b3926c0eef9b01d4c2baae1dbce7045adb7806651d
                                                                                                                                                                                                                        • Instruction ID: 3e2de8da0c0be6380c5a1391a76735ad41f62ea224c2f9136c9792b40a226387
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: baaf34aebe6e111159d882b3926c0eef9b01d4c2baae1dbce7045adb7806651d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 464226B150C3818FC722DF24C844A6EBFE2AF91314F28866DE8E95B392D735C506DB56
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: 0u4w$_q$qr$xy
                                                                                                                                                                                                                        • API String ID: 0-1225007230
                                                                                                                                                                                                                        • Opcode ID: 0bc8e236467d41b4c844bc6f0c0f01b646d1471f34f8a440b90695bf15ccba6a
                                                                                                                                                                                                                        • Instruction ID: 717d35d1b6602e5d2ada63a6d729459860c1415a565ebd5d9dfedc5c9985ab4a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0bc8e236467d41b4c844bc6f0c0f01b646d1471f34f8a440b90695bf15ccba6a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5791F0B1A083118BC718DF58C89276FB7F1EF95324F28992CE8CA8B291E374D505D756
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: ,JHj$Hs$bc$v
                                                                                                                                                                                                                        • API String ID: 0-909542228
                                                                                                                                                                                                                        • Opcode ID: ad4b43c67400b0ccafcca15083408b2c8a4fed5129e88a914fecac855cc6ed9e
                                                                                                                                                                                                                        • Instruction ID: f210d87f6d5865ed1c617f00c3be5d3d578c02e4f21426ae5baa12ce733d6edf
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ad4b43c67400b0ccafcca15083408b2c8a4fed5129e88a914fecac855cc6ed9e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C0919E71A1C3A08BE3358F3594517AFBBD2AFD3314F58896EC4C99B382C6794405CB96
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: ,JHj$Hs$bc$v
                                                                                                                                                                                                                        • API String ID: 0-909542228
                                                                                                                                                                                                                        • Opcode ID: ad4b43c67400b0ccafcca15083408b2c8a4fed5129e88a914fecac855cc6ed9e
                                                                                                                                                                                                                        • Instruction ID: 3e336a0c922376cfeef3dca043440eae048c07de291e289045cffd6a3c6cec18
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ad4b43c67400b0ccafcca15083408b2c8a4fed5129e88a914fecac855cc6ed9e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 55917A72A0D3D08BE3358B3984517ABBBD2AFD3314F18896DD4D99B382CB754409DB52
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: ,JHj$Hs$bc$v
                                                                                                                                                                                                                        • API String ID: 0-909542228
                                                                                                                                                                                                                        • Opcode ID: f1c18572ebcde3c507da4d01c59951efa700b1a2472cb7546e8eacdba262d522
                                                                                                                                                                                                                        • Instruction ID: ba8baf3debfb1281f5f3a9f4bb7f36b3e217b7d4f704efc08a24ef2861aa601e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f1c18572ebcde3c507da4d01c59951efa700b1a2472cb7546e8eacdba262d522
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FA916D71A1C3A08BE3358F3594917AFBBD2AFD3314F58896DC4C94B382CA794405CB96
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: ,JHj$Hs$bc$v
                                                                                                                                                                                                                        • API String ID: 0-909542228
                                                                                                                                                                                                                        • Opcode ID: f1c18572ebcde3c507da4d01c59951efa700b1a2472cb7546e8eacdba262d522
                                                                                                                                                                                                                        • Instruction ID: f5448f329231077b6398cd7293ab1704d55a19fb3d6e9ea64c28e128ec2f6ce7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f1c18572ebcde3c507da4d01c59951efa700b1a2472cb7546e8eacdba262d522
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B6917A72A0D3D08BE3358B3984517ABBBD2AFD3318F18896DC4D99B782CB754409DB52
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: ,JHj$Hs$bc$v
                                                                                                                                                                                                                        • API String ID: 0-909542228
                                                                                                                                                                                                                        • Opcode ID: d2c01644c1b783dc07337eb5961086e4655b708d6c2de64b3f2482e035b941c1
                                                                                                                                                                                                                        • Instruction ID: f1dd0e060a49988aa5914a4bcfde423beaa814ce8563699fb3410ac54fff71cf
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d2c01644c1b783dc07337eb5961086e4655b708d6c2de64b3f2482e035b941c1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 89918E71A1C3A08BE3358F3594517ABBFD2AFD3314F58896EC4C99B382C6794405CB96
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: ,JHj$Hs$bc$v
                                                                                                                                                                                                                        • API String ID: 0-909542228
                                                                                                                                                                                                                        • Opcode ID: d2c01644c1b783dc07337eb5961086e4655b708d6c2de64b3f2482e035b941c1
                                                                                                                                                                                                                        • Instruction ID: 8a188178c0fa57bfcb0ab43b7e4bad1c741e89aca72709af7d61014ca83430e8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d2c01644c1b783dc07337eb5961086e4655b708d6c2de64b3f2482e035b941c1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 33917A72A0D3D08BE3398B3984517ABBBD2AFD3314F18896DC4D99B682CB754409DB52
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: ,JHj$Hs$bc$v
                                                                                                                                                                                                                        • API String ID: 0-909542228
                                                                                                                                                                                                                        • Opcode ID: 3d500b1000b7ad2bbd92419dc8dce251e5a9dd8a0e3fad46196f1295967bd69e
                                                                                                                                                                                                                        • Instruction ID: 1e9c0ee7827ae846e03c62aab54aec301621c39cdfcdcbd3b33c3bf2ddd67d6a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3d500b1000b7ad2bbd92419dc8dce251e5a9dd8a0e3fad46196f1295967bd69e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4B814871A1C3A08BE3358F3994517ABBFD2AFE3314F59896DC4C94B386C6784409CB96
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: ,JHj$Hs$bc$v
                                                                                                                                                                                                                        • API String ID: 0-909542228
                                                                                                                                                                                                                        • Opcode ID: 3d500b1000b7ad2bbd92419dc8dce251e5a9dd8a0e3fad46196f1295967bd69e
                                                                                                                                                                                                                        • Instruction ID: c37cf1daf9d1e3837191d7cfaa1ebb9ad26f7d8bd2a5fa747622d4c52cd13fed
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3d500b1000b7ad2bbd92419dc8dce251e5a9dd8a0e3fad46196f1295967bd69e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EC815672A093D08FE3358F398851BABBBD2AFE3304F18896DC4C95B682C7754409CB52
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: /G$I$7N1@$Fg)i${\}
                                                                                                                                                                                                                        • API String ID: 0-149357369
                                                                                                                                                                                                                        • Opcode ID: f8d948a9f8c2ec87f02193c7bcc93b1dfc54c6f05a1ef69b06e5b5d54ec4d898
                                                                                                                                                                                                                        • Instruction ID: 3bb85dd0d4e30cb157f274853ef7a361013259300155dfa349addbe638a05ff0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f8d948a9f8c2ec87f02193c7bcc93b1dfc54c6f05a1ef69b06e5b5d54ec4d898
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9D2188B551E3809BC314CF66884161BFBE2BBD2704F29A92DF0C85B255D7748902CF8B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InitializeThunk
                                                                                                                                                                                                                        • String ID: ,$i$r}A
                                                                                                                                                                                                                        • API String ID: 2994545307-2114006112
                                                                                                                                                                                                                        • Opcode ID: 0e4b36d0337e01a9c7c8ce5630e9dd0ade0f1867cda4b4963c273f19514711e6
                                                                                                                                                                                                                        • Instruction ID: 71abf614919c99122684cd8b50d12f0618c33dd175a6392faed4f31dbac36a6d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0e4b36d0337e01a9c7c8ce5630e9dd0ade0f1867cda4b4963c273f19514711e6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 90427976A087508FD324CF69D8807ABBBE2EB96300F1D492ED4D5A7352C7389845C796
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: gfff$i$r}A
                                                                                                                                                                                                                        • API String ID: 0-3931832132
                                                                                                                                                                                                                        • Opcode ID: 63d4f06d283b13aa9aabc31ef275959d287b6dadcbde27f9351af1790c00577d
                                                                                                                                                                                                                        • Instruction ID: 86030a502c6fbeff1aeb5632b982c99bae1c365f88ce42af9c09e5b1275022bd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 63d4f06d283b13aa9aabc31ef275959d287b6dadcbde27f9351af1790c00577d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 74028A76A483118BD724CF28D8817ABBBE2EBD2300F19852ED4C5D7392DB389945C786
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: <pr$st$y./
                                                                                                                                                                                                                        • API String ID: 0-3839595785
                                                                                                                                                                                                                        • Opcode ID: a785fe897820364b60474d4d38e44689b11c67a14769611824ea7061f52dc378
                                                                                                                                                                                                                        • Instruction ID: 75883d3ccedddef3a45dabbf5554b36173ac4c5341f315a2b5b284ed2e941cbb
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a785fe897820364b60474d4d38e44689b11c67a14769611824ea7061f52dc378
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A6C16872B083206BD7149B25D95263BB3E1EFD4314F59852EE88697381E6BCD805C39A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: <pr$st$y./
                                                                                                                                                                                                                        • API String ID: 0-3839595785
                                                                                                                                                                                                                        • Opcode ID: 9e143f35872cbb7a2f64fee134240a1c59abbcbee3e9395d2d3f1030c864cd5b
                                                                                                                                                                                                                        • Instruction ID: bd3a7c6b2cf08698c7b0a37decae99ae073059e5f3c2eee756fe46e14d360d1a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9e143f35872cbb7a2f64fee134240a1c59abbcbee3e9395d2d3f1030c864cd5b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EEC14772A093018FD7259F28C852B6BB3E2EFC5324F19852DED9687382E3749905D792
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: 34$C]$|F
                                                                                                                                                                                                                        • API String ID: 0-2804560523
                                                                                                                                                                                                                        • Opcode ID: 7bec5bc3369f6adcf9dfe2aa521af371a2ac693f70b7f14cbe9fa8a8d0a997b9
                                                                                                                                                                                                                        • Instruction ID: 2c432fa7c5999ab476cb5019d0599193357fe59285c965ab9162d9f100ef16a5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7bec5bc3369f6adcf9dfe2aa521af371a2ac693f70b7f14cbe9fa8a8d0a997b9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E2C1F1B59183118BC720CF28C8816ABB3F2FFD5314F58895DE8D58B390E778A945C79A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: #XXL$=$BC
                                                                                                                                                                                                                        • API String ID: 0-2546488661
                                                                                                                                                                                                                        • Opcode ID: de1a02a15010d669723b7442fb5946c988934c5b7e4ce427fae25988c8326dc7
                                                                                                                                                                                                                        • Instruction ID: 9bd2012f957da0ff56630068cab070879dad6f1475f4ae026007fe123ff5be4b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: de1a02a15010d669723b7442fb5946c988934c5b7e4ce427fae25988c8326dc7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 62C1EBB15083518BD324CF15C8A17ABBBE2FFD1704F0A895ED4C55B3A1EBB88845CB96
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InitializeThunk
                                                                                                                                                                                                                        • String ID: 1234$oQ3$sQ3
                                                                                                                                                                                                                        • API String ID: 2994545307-3057079318
                                                                                                                                                                                                                        • Opcode ID: a6f3f14e2653e663308f11d691e247aa7faefb8ce40ce58f1613db28e40f636f
                                                                                                                                                                                                                        • Instruction ID: 8038275947b79c29346f8cf0c7e67bd1178385f5d69ec54105c16415a8137388
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a6f3f14e2653e663308f11d691e247aa7faefb8ce40ce58f1613db28e40f636f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8DB16472A083118FC728DF28C89056BB7E2EBC9314F19853DE99697365E735ED05CB82
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: 12347$oQ3$sQ3
                                                                                                                                                                                                                        • API String ID: 0-1755585375
                                                                                                                                                                                                                        • Opcode ID: d6219592765054223d8b44a29d17a2c15be9e83531692649a6c6d0283300f812
                                                                                                                                                                                                                        • Instruction ID: 392a5363c6f240326dc1865c0b6413e5436fee26f50a7cae7d4db71665159248
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d6219592765054223d8b44a29d17a2c15be9e83531692649a6c6d0283300f812
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: ABB17732A083528FCB19CF28C89456BBBE2EBC5304F19852CE9979B751D731ED81D781
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: Ef$TQ][$sWK)
                                                                                                                                                                                                                        • API String ID: 0-3401374238
                                                                                                                                                                                                                        • Opcode ID: 2018eb1ddcc6c4d2b6b82b9d22d54321858e2bd23606dd915e7f156b5046d053
                                                                                                                                                                                                                        • Instruction ID: 19a0c778187f2748ae17dd07c5e08606c1358576a23e797e2c0b4f31c76305c1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2018eb1ddcc6c4d2b6b82b9d22d54321858e2bd23606dd915e7f156b5046d053
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CBB1C33061C3E08ED7398F2994507ABBBE09F97304F48499DD4D95B382DB79850ACBA7
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: Ef$TQ][$sWK)
                                                                                                                                                                                                                        • API String ID: 0-3401374238
                                                                                                                                                                                                                        • Opcode ID: 34b98bce0e098604bc8c30d8401df6549c9b0a7e4ea807236a6bc4bf95e6afdf
                                                                                                                                                                                                                        • Instruction ID: 5e6348592c33fe170dd6f46a3795d394d0373f014b57e9d66518e0f0f4597968
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 34b98bce0e098604bc8c30d8401df6549c9b0a7e4ea807236a6bc4bf95e6afdf
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 74B1D23051D3D08ED73A8F29D4907ABBBE0AF97208F08899DD4D95F282D775850ADB63
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: +|-~$/pqr$_
                                                                                                                                                                                                                        • API String ID: 0-1379640984
                                                                                                                                                                                                                        • Opcode ID: 4a5a7f83b503959aed81fc9274c5a394571bb0f6731898145231dc30ce1a0eba
                                                                                                                                                                                                                        • Instruction ID: 042a524babaaaf1240c13a88dd3a117b8cd22f0ed9ec4b151ea40a3d869026f8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4a5a7f83b503959aed81fc9274c5a394571bb0f6731898145231dc30ce1a0eba
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D9810A5561495006DB2CDF3489A333BAAD79F84308B2991BFC995CFBABE93CC502874D
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: +|-~$/pqr$_
                                                                                                                                                                                                                        • API String ID: 0-1379640984
                                                                                                                                                                                                                        • Opcode ID: 6cec998220da979fd4d7e4802d464de526f10a737984141f1598214dad803a78
                                                                                                                                                                                                                        • Instruction ID: 2bf32f426c5a3d5f97cb77baf2a0b3875dac4f21f57bd7719e7ac4752028eb29
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6cec998220da979fd4d7e4802d464de526f10a737984141f1598214dad803a78
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 30813C5160468006DB2DDF3888A377BBAD79F84308B2DD1BEC955CFBA6E938C102874D
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: .$GetProcAddress.$l
                                                                                                                                                                                                                        • API String ID: 0-2784972518
                                                                                                                                                                                                                        • Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
                                                                                                                                                                                                                        • Instruction ID: 2c8b122756e7d1c76dbf3307e28635d16f169baddcd9f84f6343000e4a12ced9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D23149B6900709DFDB21CF99C880AEEBBF6FF48324F14415AD441A7250D771EA45CBA4
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: NDNK$WJeX$X
                                                                                                                                                                                                                        • API String ID: 0-3631875968
                                                                                                                                                                                                                        • Opcode ID: d11f5f5163d6808065bde529015e1f128c891bcdaf4957bf72f467d8a2f5d03f
                                                                                                                                                                                                                        • Instruction ID: 91f976eecf254ec7c88bbcb3bc0a789914132bba1b5730ee2c110481d70de43d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d11f5f5163d6808065bde529015e1f128c891bcdaf4957bf72f467d8a2f5d03f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D301B1B091D790CFD3B19F25985969FBFE4AB82310F20492CC5C9A6221DA3684018F07
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: "51s$9YB
                                                                                                                                                                                                                        • API String ID: 0-2722061943
                                                                                                                                                                                                                        • Opcode ID: 211a046e9116838b58fef2f862f3bc43e5d0a454b8724f73db8adee7e8caa559
                                                                                                                                                                                                                        • Instruction ID: 779a5c1bb40158b59da43047085edf677e041d4ba635d65d9609cd33f89ab022
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 211a046e9116838b58fef2f862f3bc43e5d0a454b8724f73db8adee7e8caa559
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EE321976B00622CBCB24CF68D8516BFB3B2FF89310B99856DD442AB364DB395D41CB54
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: !@$,
                                                                                                                                                                                                                        • API String ID: 0-2321553346
                                                                                                                                                                                                                        • Opcode ID: 00a3d0f56e47fa8dbf69d309b3c8ad0eabeffacace6d1066a3ad4a95fdf331ff
                                                                                                                                                                                                                        • Instruction ID: 02546279eb0c4d83f3c4e3be5ab3571bc15c22c1dfd1b9922496e5385efd982e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 00a3d0f56e47fa8dbf69d309b3c8ad0eabeffacace6d1066a3ad4a95fdf331ff
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DB4259B1E042648FDB04CF78D8813AEBFF1AF55310F59826ED895A7391C3798846CB86
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: !@$,
                                                                                                                                                                                                                        • API String ID: 0-2321553346
                                                                                                                                                                                                                        • Opcode ID: 53d5da5660c4a43f8d0f64280c8733e9bdccf6cbe85e2db49c8b0f6515059a90
                                                                                                                                                                                                                        • Instruction ID: af04c14d06578878a551c2a50c5082db0f831202b100ed2e429185ccdfcdcf12
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 53d5da5660c4a43f8d0f64280c8733e9bdccf6cbe85e2db49c8b0f6515059a90
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 854204B1D053548FDB04CF78C8853AEBFF1AF49310F098269E899AB392D7358945DB92
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: 0K)$4*VP
                                                                                                                                                                                                                        • API String ID: 0-3626284114
                                                                                                                                                                                                                        • Opcode ID: 958d662d80f610fa8de2bec6fdd7d8beff1fa42db32f20cab0fd5fd8684a20d5
                                                                                                                                                                                                                        • Instruction ID: 008d95a2d83e2f5499268ad317331d9597a1a03330b6bf41a51ab9e3d2b7448f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 958d662d80f610fa8de2bec6fdd7d8beff1fa42db32f20cab0fd5fd8684a20d5
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 01D1063161D3D08ED7268B39C4507ABFFE19FA7218F1889ADD4D98B382C7758406DB62
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: 0K)$4*VP
                                                                                                                                                                                                                        • API String ID: 0-3626284114
                                                                                                                                                                                                                        • Opcode ID: 7f9184ee53db8657b7211f9213731764c2e24f7097ca2d92dc8b3e88ab6ab3dd
                                                                                                                                                                                                                        • Instruction ID: 79d6e082e0491a4045e5b840a95bb4df230d34c241beba690eb3c8ed7007ce5a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7f9184ee53db8657b7211f9213731764c2e24f7097ca2d92dc8b3e88ab6ab3dd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8FD12730A1C3D08ED7258F3994507ABBFE19FA7314F59896ED4C98B382C7798406CB66
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: R2B$6B
                                                                                                                                                                                                                        • API String ID: 0-20043878
                                                                                                                                                                                                                        • Opcode ID: ac58904699f18f78ac368c51fcd47e09c00d21abb36880cf37e6842ead4d4e32
                                                                                                                                                                                                                        • Instruction ID: f5db2046e1d380e536cc29ae1ea4695f6a7d49829660d0c0f3bd76f15908f1aa
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ac58904699f18f78ac368c51fcd47e09c00d21abb36880cf37e6842ead4d4e32
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3AD1C276A01116CFDB18CF68DC917AE73B2FB8A311F1A85A9D841E7390DB34AD11CB58
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: XG$|}
                                                                                                                                                                                                                        • API String ID: 0-1014376750
                                                                                                                                                                                                                        • Opcode ID: e601669f8485cc3344b93b58b39bec23c35c7299807bf4f05dda551d1a5ff6f0
                                                                                                                                                                                                                        • Instruction ID: fef0f9a3622c059bd3dca30c9da84c32a684abbcbc54a65241ce9b590edefb0f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e601669f8485cc3344b93b58b39bec23c35c7299807bf4f05dda551d1a5ff6f0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: ECD122B16083108BD724DF18D8927ABB7F2FFE5354F49891DE5868B3A1E7788801CB56
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: XG$|}
                                                                                                                                                                                                                        • API String ID: 0-1014376750
                                                                                                                                                                                                                        • Opcode ID: dab4d877ca047d4bef4a60ac035a74c1689232e455a040bcd58bfaed14168dbd
                                                                                                                                                                                                                        • Instruction ID: a0e288db21454d80970fa50ef88c3d467829df64a8dbcce209779f254e8ebc14
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dab4d877ca047d4bef4a60ac035a74c1689232e455a040bcd58bfaed14168dbd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C0D104B15093408BD724CF14C8927ABB7F1FFC2358F09891CE5958B3A1EB799401DB52
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: )$IEND
                                                                                                                                                                                                                        • API String ID: 0-707183367
                                                                                                                                                                                                                        • Opcode ID: a91b974ffb7970066f5ddd55fbf8d6bd18980178a5d0d12c0270eeeb14f23bc6
                                                                                                                                                                                                                        • Instruction ID: dbf6d47144c6b822b2acdb98883b9d528113f132bac91ec627b85730d464e823
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a91b974ffb7970066f5ddd55fbf8d6bd18980178a5d0d12c0270eeeb14f23bc6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 34D1CEB15083449FE720CF14D84575FBBE4AB94308F14492EFA99AB3C2E779D908CB96
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: )$IEND
                                                                                                                                                                                                                        • API String ID: 0-707183367
                                                                                                                                                                                                                        • Opcode ID: e75c78a806b7862965fdc8e28a2ab248e9bd6dbcacf7bf91078409fb9652b6c0
                                                                                                                                                                                                                        • Instruction ID: c2873574608189f20c3e49cbfc82c9f51c414536c2396ec1200f3a9a236d6283
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e75c78a806b7862965fdc8e28a2ab248e9bd6dbcacf7bf91078409fb9652b6c0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4DD1ADB1908344DFD721CF28C854B9EBBE4AF94304F14892DF9999B382D375DA08DB96
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InitializeThunk
                                                                                                                                                                                                                        • String ID: i$r}A
                                                                                                                                                                                                                        • API String ID: 2994545307-2976846027
                                                                                                                                                                                                                        • Opcode ID: 216b221475836e3855d1b8759aff26348fc53bb82e04dccbb46422255a771982
                                                                                                                                                                                                                        • Instruction ID: bf893d2c0726f4e317e2b51d5e32a95bc91f637e65c50f94937d3483e244f6d9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 216b221475836e3855d1b8759aff26348fc53bb82e04dccbb46422255a771982
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4781A83694C351CFD710CF68D8806ABBBE2EBD2300F18496ED8D697252C7389985C7CA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: d$d
                                                                                                                                                                                                                        • API String ID: 0-195624457
                                                                                                                                                                                                                        • Opcode ID: 5ae760aa5af7d138e0a7bd51aa20738c42f63bbe965dfb313ec005962f2f09c8
                                                                                                                                                                                                                        • Instruction ID: a6a5a8ac2d59b7de1a8b575b3a10bb681eff341670204cea3f60d1849e0cf04e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5ae760aa5af7d138e0a7bd51aa20738c42f63bbe965dfb313ec005962f2f09c8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F1513A36908320CBC714CF24D85162BB7D2AB8A718F494A6DECC9A7351D7369D15CB8B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: P<?$P<?
                                                                                                                                                                                                                        • API String ID: 0-3449142988
                                                                                                                                                                                                                        • Opcode ID: 15a1e53f96b5dbffac6245dad95bb33219b4ef4f3549f5551b78542ea9aaefbe
                                                                                                                                                                                                                        • Instruction ID: 58e7122ac3cea56caf2700395258951e32a9ff530ffc896d1714b79e34f88e6e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 15a1e53f96b5dbffac6245dad95bb33219b4ef4f3549f5551b78542ea9aaefbe
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 64312976A44310EFD7208F54C880BBBB7A6F789300F58D92ED5C9A3251DB745C84879B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InitializeThunk
                                                                                                                                                                                                                        • String ID: f
                                                                                                                                                                                                                        • API String ID: 2994545307-1993550816
                                                                                                                                                                                                                        • Opcode ID: 8e9e50587fb6b78e0fa4282dd31e32de0d85a4e7deb78124e5aaaf4c71ac60a2
                                                                                                                                                                                                                        • Instruction ID: 18f220f42ed12d3f8706e230857eda4cfb4a422739cf4bd3cfbe98504a66e541
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8e9e50587fb6b78e0fa4282dd31e32de0d85a4e7deb78124e5aaaf4c71ac60a2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8512D3706083418FD715CF28C88176FB7E5EB89314F289A2EE6E597392D734DC058B9A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: bC
                                                                                                                                                                                                                        • API String ID: 0-3681614764
                                                                                                                                                                                                                        • Opcode ID: 81246caaa5fb78c3d38635f3ad354d87a7ab4eb57a3eaf3217e543b2d80e8b50
                                                                                                                                                                                                                        • Instruction ID: 871c5afb2dffc20ff0dbbcf53a0195aac73061a90b0e28cef4dba4d31fdaf636
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 81246caaa5fb78c3d38635f3ad354d87a7ab4eb57a3eaf3217e543b2d80e8b50
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3712E23AA18215CFCB04CF28E8905AAB7B2FF8E311F1A847DD54697351D734A952CB88
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: bC
                                                                                                                                                                                                                        • API String ID: 0-3681614764
                                                                                                                                                                                                                        • Opcode ID: c70fff483ec8e9077dfc10fa089d78eeba6ca480428d69a1677b3b3847d620ad
                                                                                                                                                                                                                        • Instruction ID: 5e30844967bebdc7bd1579877bde578fcf76ae60555b00215fe6639be0914efa
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c70fff483ec8e9077dfc10fa089d78eeba6ca480428d69a1677b3b3847d620ad
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7DF1E436A28215CFCB04CF28E8905AAB7F2FF8E311F19847DD94697351D734A952CB88
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: Dx
                                                                                                                                                                                                                        • API String ID: 0-3832465965
                                                                                                                                                                                                                        • Opcode ID: ff34d217169f84ecf3502b05061dc3eb4241f1b5e2f3e4b9a9a76cc037eed5b2
                                                                                                                                                                                                                        • Instruction ID: 5bb1130f72a98c6f233d2c217a903bc57bb56de3339a3108bfc93ec34e4a158e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ff34d217169f84ecf3502b05061dc3eb4241f1b5e2f3e4b9a9a76cc037eed5b2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A1F1CDB054C3D18ED335CF6594907EBBBE0EB92314F144AAEC8D96B382C735090A8B97
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: Dx
                                                                                                                                                                                                                        • API String ID: 0-3832465965
                                                                                                                                                                                                                        • Opcode ID: ff34d217169f84ecf3502b05061dc3eb4241f1b5e2f3e4b9a9a76cc037eed5b2
                                                                                                                                                                                                                        • Instruction ID: a0987e295c78ce54dd301000c7f3f674e8d6becaacfbb335a97e5219405e1ed7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ff34d217169f84ecf3502b05061dc3eb4241f1b5e2f3e4b9a9a76cc037eed5b2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CAF1DCB050D3D18ED376CF658484BDBBBE1AF92718F184AADC8D96B642C735050ACB93
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: bC
                                                                                                                                                                                                                        • API String ID: 0-3681614764
                                                                                                                                                                                                                        • Opcode ID: 1d8feeef0126ffe8c63342afaba4558ed33c57e7ba78c596c66c7e0fa34e77c1
                                                                                                                                                                                                                        • Instruction ID: 5e6aaad999615e2ac42fefb03cf1b536ced96fd12a8bf48793a25e995ad5db17
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1d8feeef0126ffe8c63342afaba4558ed33c57e7ba78c596c66c7e0fa34e77c1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BAF1E536A28215CFCB04CF68E8905AAB7F2FF8E311F19847DD94697351D734A952CB88
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: bC
                                                                                                                                                                                                                        • API String ID: 0-3681614764
                                                                                                                                                                                                                        • Opcode ID: b154c6e34f79c6648591b9b450c448a67bbc93cb44fa5396b7d9856807c8a211
                                                                                                                                                                                                                        • Instruction ID: a5988ab96186a7325d1362fbcccc642df08cbf2eaa279a3d6103cdc8c7b46e1e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b154c6e34f79c6648591b9b450c448a67bbc93cb44fa5396b7d9856807c8a211
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B7F1F536A28215CFCB04CF68E8905AAB7F2FF8E311F19847DD94697351D734A952CB88
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: jk
                                                                                                                                                                                                                        • API String ID: 0-78326018
                                                                                                                                                                                                                        • Opcode ID: 25ef1f9adb694a81f93120e111aa8eff1c89ad6ac93ee7fa2faf286b71ff90ec
                                                                                                                                                                                                                        • Instruction ID: 68e7885be5d05e4a2cf040f704cbb8fa7a41bea7ef2f0d8a510bf149587bd7f9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 25ef1f9adb694a81f93120e111aa8eff1c89ad6ac93ee7fa2faf286b71ff90ec
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DDE1033A618356CBC7188F38DC5126B73E2FF4A351F0AC87DE9818B2A0E779C9558754
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: bC
                                                                                                                                                                                                                        • API String ID: 0-3681614764
                                                                                                                                                                                                                        • Opcode ID: 10f45940bf441a6cd71f6e58040424d3e031c37bab43412074f48cf734061f8b
                                                                                                                                                                                                                        • Instruction ID: 2fa55bda5e41fd724e566356672d144f9f42af162050902131bcbf15531586af
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 10f45940bf441a6cd71f6e58040424d3e031c37bab43412074f48cf734061f8b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E9E1C376A28215CFCB08CF28E8905AAB7F2FF8E310F19857DD94697351D734A952CB84
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: {}
                                                                                                                                                                                                                        • API String ID: 0-4269290415
                                                                                                                                                                                                                        • Opcode ID: ae2110e227aeaa4557827879407c3dbec5839db0e2fe540aba91c9e8bccdbcdd
                                                                                                                                                                                                                        • Instruction ID: 0af4e1219fe889d167e9da05173529857e0f89c87775fbd0e3160429af4db955
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ae2110e227aeaa4557827879407c3dbec5839db0e2fe540aba91c9e8bccdbcdd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 82E101B5608340DFE724DF24E88176FB7B2FB85304F54893DE5859B2A2DB789805CB4A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: "
                                                                                                                                                                                                                        • API String ID: 0-123907689
                                                                                                                                                                                                                        • Opcode ID: f5bf1b62e76307cdd5fc82252a9a1afcae73f4398661cde8b6da05f895bcd9dc
                                                                                                                                                                                                                        • Instruction ID: ccf2f4e9833933b2009195e793b8faf6d5d6e2cba860aec0098ae2c38f35b308
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f5bf1b62e76307cdd5fc82252a9a1afcae73f4398661cde8b6da05f895bcd9dc
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FDD11F72B083255FC714CE25A89076BB7DAAF84350F89892EECA987381D738DD15C7C6
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: "
                                                                                                                                                                                                                        • API String ID: 0-123907689
                                                                                                                                                                                                                        • Opcode ID: c49dafb76b3501854f1ecfb32a5253d7c55cb79f5b02df7c17b1cbb688f3955d
                                                                                                                                                                                                                        • Instruction ID: 1b709b9cecfc90c3b73bc87c7337cf6ba0a462ed4326a8fde00d295d01345fff
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c49dafb76b3501854f1ecfb32a5253d7c55cb79f5b02df7c17b1cbb688f3955d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7BD10872A093559FCB15CE24C4807AFBBEAAFC4318F0A896DE89587381D775D904DBC1
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InitializeThunk
                                                                                                                                                                                                                        • String ID: /,-
                                                                                                                                                                                                                        • API String ID: 2994545307-1700940157
                                                                                                                                                                                                                        • Opcode ID: e68cf86ee166e556bd12f2f12a5a46f9bc2d0c12cb890ba0df125163a2fef21b
                                                                                                                                                                                                                        • Instruction ID: 73ea5f1ed436ac76404857fefd2ddfa4c8367646346d3918638d2e9e73e3d7e7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e68cf86ee166e556bd12f2f12a5a46f9bc2d0c12cb890ba0df125163a2fef21b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8EB18E717083014BD714DF25888163BF792EBCA314F14A92EF5D557392DB39EC068B9A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: /,-
                                                                                                                                                                                                                        • API String ID: 0-1700940157
                                                                                                                                                                                                                        • Opcode ID: bd61eaabca8c3d4106ab26b04688d9f0e7a3b9e8178b00c10dfc939fc062fcac
                                                                                                                                                                                                                        • Instruction ID: 15f20d6d593027d52ef7624b8d74d2eb6a92bfedc9969f6f3122d34cb867519e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bd61eaabca8c3d4106ab26b04688d9f0e7a3b9e8178b00c10dfc939fc062fcac
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 93B157707083404FEB559B248880A7FB7E2EF82328F18C92CD597572A1D731EC85EB86
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InitializeThunk
                                                                                                                                                                                                                        • String ID: VtA
                                                                                                                                                                                                                        • API String ID: 2994545307-3724035812
                                                                                                                                                                                                                        • Opcode ID: e8c9bba709d658e790e2a6ad064546b7b8b5661d45e7256e4bece47e75e6f2c0
                                                                                                                                                                                                                        • Instruction ID: ed71193d6b2bdbbac52031f97d74cd30495a87e66650ae04c888d17f76a05038
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e8c9bba709d658e790e2a6ad064546b7b8b5661d45e7256e4bece47e75e6f2c0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5DC139766083419FD714CF28D8817AFB7E2AB95310F09892EE4D5D7392C738D885C75A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: bC
                                                                                                                                                                                                                        • API String ID: 0-3681614764
                                                                                                                                                                                                                        • Opcode ID: 12f582ca5cb52f02cbb6c7a65b3a2962543ce7e68b8d395708436d5f2da692ba
                                                                                                                                                                                                                        • Instruction ID: 4d20f92c875f40788edf4275f174b054e137e174bc84352c0492b1430194fbac
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 12f582ca5cb52f02cbb6c7a65b3a2962543ce7e68b8d395708436d5f2da692ba
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F3C1C176A28215CFCB08CF68E8905AAB7F2FF8E310F19897DD54597351C734A952CB84
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: 9YB
                                                                                                                                                                                                                        • API String ID: 0-659603884
                                                                                                                                                                                                                        • Opcode ID: cc1449e27a0f5531b09e40fa76c2dd5bb8592e6f2d5bdd274fc9f48ccbd80c23
                                                                                                                                                                                                                        • Instruction ID: 1cfe0ac6ad2819008f92b10fbbf01a1b5c50993105dc128c753fe97305f097ae
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: cc1449e27a0f5531b09e40fa76c2dd5bb8592e6f2d5bdd274fc9f48ccbd80c23
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 80B1077AA00215CBDB18CFA9D8916BFB7B2FF89310F58816DD442AB355DB395C42CB84
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: .
                                                                                                                                                                                                                        • API String ID: 0-248832578
                                                                                                                                                                                                                        • Opcode ID: 2ac21a3dbd00c1a7cfa2cfa9c8571f5cf891ae991bce99d29bc9653d85f38a4a
                                                                                                                                                                                                                        • Instruction ID: 2823e07fbbb50db066b2c442ced4ae8f01fbddd957871d70742adaa2677f6ced
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2ac21a3dbd00c1a7cfa2cfa9c8571f5cf891ae991bce99d29bc9653d85f38a4a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FE912A71E082524BC721CE29CA8025BB7E5AB81350F198A7ED8D5E73D1EA39DD414BC5
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: .
                                                                                                                                                                                                                        • API String ID: 0-248832578
                                                                                                                                                                                                                        • Opcode ID: 2ac21a3dbd00c1a7cfa2cfa9c8571f5cf891ae991bce99d29bc9653d85f38a4a
                                                                                                                                                                                                                        • Instruction ID: d20289324d0866d84396b018135cd4655d9dd5a61c8c639da7c5c083f57f3a4a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2ac21a3dbd00c1a7cfa2cfa9c8571f5cf891ae991bce99d29bc9653d85f38a4a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F5912771E083528BC7339E29C8843DAB7E9AF81354F18CA69E8D4D76B1E734D9419BC1
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: 0
                                                                                                                                                                                                                        • API String ID: 0-4108050209
                                                                                                                                                                                                                        • Opcode ID: 08d7d0d85d1217bd50795314ef511c4ead64b35a0bf6ca8811da1f806bdc1b7e
                                                                                                                                                                                                                        • Instruction ID: 9f054d13e7867a4d77ca7132c07c00ca598ea50f9319f8eda39875565fe9693e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 08d7d0d85d1217bd50795314ef511c4ead64b35a0bf6ca8811da1f806bdc1b7e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AD914827759A8007D31C9E3D5C622A7BA834BEB330F2DD37EA5B1CB3E5D56888064359
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: 0
                                                                                                                                                                                                                        • API String ID: 0-4108050209
                                                                                                                                                                                                                        • Opcode ID: 08d7d0d85d1217bd50795314ef511c4ead64b35a0bf6ca8811da1f806bdc1b7e
                                                                                                                                                                                                                        • Instruction ID: 373533886fdd325cf41b2979aea219a401ab5ce32d13c9da91ddcd1d4005ea63
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 08d7d0d85d1217bd50795314ef511c4ead64b35a0bf6ca8811da1f806bdc1b7e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 53914A23759BC00BD71C9E3C4C622AABA834BD7230B2DC37DB5B2DB3E5D6A948459351
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: ,
                                                                                                                                                                                                                        • API String ID: 0-3772416878
                                                                                                                                                                                                                        • Opcode ID: af61cab23f3548dae23a0013b9021eac7b62495e940c422da8dd81882780f669
                                                                                                                                                                                                                        • Instruction ID: 72525c85f477075dffe7e14f80d8e4d34094ebf61648e765f9981e94dfd3314a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: af61cab23f3548dae23a0013b9021eac7b62495e940c422da8dd81882780f669
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 88B137711087859FC321DF18C88061BFBE0AFA9704F444A2EF5D997782D675E918CB67
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: ,
                                                                                                                                                                                                                        • API String ID: 0-3772416878
                                                                                                                                                                                                                        • Opcode ID: af61cab23f3548dae23a0013b9021eac7b62495e940c422da8dd81882780f669
                                                                                                                                                                                                                        • Instruction ID: ca5599eba9c6080ed45ee5471572243f41004c0b1d49fde9ae2a4c868f5d8641
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: af61cab23f3548dae23a0013b9021eac7b62495e940c422da8dd81882780f669
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 76B149705083819FD321CF18C88065BFBE4AFA9304F484E2DE5D997342D631EA18CBA6
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: gfff
                                                                                                                                                                                                                        • API String ID: 0-1553575800
                                                                                                                                                                                                                        • Opcode ID: 04eae5f35bf542833f546afa72f4753c6069cb9a74afe6c9c0fa956fc9adcb4f
                                                                                                                                                                                                                        • Instruction ID: d0003075f6a93709cb18aaaf79b0dba45c237e911dfbd9611a34e58172432f07
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 04eae5f35bf542833f546afa72f4753c6069cb9a74afe6c9c0fa956fc9adcb4f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 107135B2A583418BD728CB28C851BBFB6DAEBC1304F19813DD581DB2A5DB789905DB81
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: "
                                                                                                                                                                                                                        • API String ID: 0-123907689
                                                                                                                                                                                                                        • Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
                                                                                                                                                                                                                        • Instruction ID: 33b1f2780e14060464d7ed180fcf8b3e4403934f6fcecc96c03af05ff21b71f5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4A71D732B083358BD714CE28E48432FB7E2EBC5750FA9856EE89497351D7389C4587CA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: "
                                                                                                                                                                                                                        • API String ID: 0-123907689
                                                                                                                                                                                                                        • Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
                                                                                                                                                                                                                        • Instruction ID: 683460f80499cd850ba924e2649c31375d4b0f321acca62b84778fde7d8228e9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A8711432A093558BD725CE2CC48032EBBE2ABC571CF1AC52DE4949B395D735EC45EB82
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: klm
                                                                                                                                                                                                                        • API String ID: 0-3800403225
                                                                                                                                                                                                                        • Opcode ID: d5319d95fe68aebd98aaca92b9825a3df1dae6eff9af15c4fe87a1423c5b3b77
                                                                                                                                                                                                                        • Instruction ID: fbab8d391cb70804594fb2969dbf4b57704b04da195ac2ac4d1ccbe35a174314
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d5319d95fe68aebd98aaca92b9825a3df1dae6eff9af15c4fe87a1423c5b3b77
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9751F3B4A0D3508BD314EF25D81276BB7F2EFA6348F18856EE4D54B391E7398501CB1A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: klm
                                                                                                                                                                                                                        • API String ID: 0-3800403225
                                                                                                                                                                                                                        • Opcode ID: 22a1d23ffb192b13ce7e4b67b3c031d181d26310d43a75b7846801cd596ae7fb
                                                                                                                                                                                                                        • Instruction ID: 19e925cbcc01d9f77dc52082f68a9dd4427ea161451268204c698f0e7c6132e1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 22a1d23ffb192b13ce7e4b67b3c031d181d26310d43a75b7846801cd596ae7fb
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C051E1B46093518BD714DF24C85276FB7F2FFA6308F28996CE4D68B290E7358501DB1A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: pF
                                                                                                                                                                                                                        • API String ID: 0-4112324664
                                                                                                                                                                                                                        • Opcode ID: fe2049b3d9abf6bd8e08d2fec2b5cc8118d281e5b2e668e1a48ceb0649ab8eab
                                                                                                                                                                                                                        • Instruction ID: 4b15e4364feff8b1cae5d4f97873799dd65533a9f2e3c3f3723fc524ea0f092f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fe2049b3d9abf6bd8e08d2fec2b5cc8118d281e5b2e668e1a48ceb0649ab8eab
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6651C572E442698BDB28CF68D8513DEB7B2FB84304F1581BEC55AEB384CB3449468F81
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InitializeThunk
                                                                                                                                                                                                                        • String ID: ?^A
                                                                                                                                                                                                                        • API String ID: 2994545307-4120214115
                                                                                                                                                                                                                        • Opcode ID: 2c308a6fbd29e83612078340da99c3c212b60cd104204cd4e1c6453a1b582895
                                                                                                                                                                                                                        • Instruction ID: 9ee6d34e9011fc7addbd5ae762574014bc539ca284b22a695acd6cfcc742d02e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2c308a6fbd29e83612078340da99c3c212b60cd104204cd4e1c6453a1b582895
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2141783A648300DFE3248B94D880ABBBBA3B7D5310F5D552EC5C527222CB745C81878F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: 6B
                                                                                                                                                                                                                        • API String ID: 0-4127139157
                                                                                                                                                                                                                        • Opcode ID: e4ae7821e595edd76aaa032931955796ee87cd6bb1a1de6a8bf0ae27a5d1bb00
                                                                                                                                                                                                                        • Instruction ID: 96ac195b9b02395a12e3507be26d084a31814086cf7b4e33e8fc611c97ddc8d1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e4ae7821e595edd76aaa032931955796ee87cd6bb1a1de6a8bf0ae27a5d1bb00
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 90416A79A05102CFE708CF68EC917A9B3B2FF8A311F5A45B8D545E7390CB74A951CB48
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: $%
                                                                                                                                                                                                                        • API String ID: 0-4214564638
                                                                                                                                                                                                                        • Opcode ID: d78bc3d5ce02b10deb2a392cf77ba543051be3d806e39ea4f7dd24e4e80accd5
                                                                                                                                                                                                                        • Instruction ID: 3a12058a654eb28ab9a6ec9325260f0da8ac6e7581b620ea067b04d8af41a39e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d78bc3d5ce02b10deb2a392cf77ba543051be3d806e39ea4f7dd24e4e80accd5
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 694124B0E022298BCB10CF99E8513AEB7B1FF55310F09825DE441AB790E7785941CB64
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: ,+*)
                                                                                                                                                                                                                        • API String ID: 0-3529585375
                                                                                                                                                                                                                        • Opcode ID: d0860ee87a3522d35f46aac91f37c79de7283bf131867904a39b4a27e1383bdc
                                                                                                                                                                                                                        • Instruction ID: 68cfe137d2ab0af7dce5a58d9434fe9363a9de560f42f495304c8ca0a6612520
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d0860ee87a3522d35f46aac91f37c79de7283bf131867904a39b4a27e1383bdc
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3A31A579B403119FEB15CF58CC95BBEB3B2BB49304F185129D552A7390CB76AD01C754
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: o`
                                                                                                                                                                                                                        • API String ID: 0-3993896143
                                                                                                                                                                                                                        • Opcode ID: 62f776dcc95a1318bd9c29a2d25ade0fb881a9597666cacb70b5fb249bcdf744
                                                                                                                                                                                                                        • Instruction ID: 0bdba0f6bf2b5cd18ae264ba298f37260da84434396a298b3053f459174327b1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 62f776dcc95a1318bd9c29a2d25ade0fb881a9597666cacb70b5fb249bcdf744
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9C11C270218340AFC310DF65DDC1B6BBFE2DBC2204F65983DE185A72A1C675E9499719
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: o`
                                                                                                                                                                                                                        • API String ID: 0-3993896143
                                                                                                                                                                                                                        • Opcode ID: 62f776dcc95a1318bd9c29a2d25ade0fb881a9597666cacb70b5fb249bcdf744
                                                                                                                                                                                                                        • Instruction ID: d8b8cd2a9f5a7336426b536785f8843e25fe2d5d13065121dea092fe1bbf639c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 62f776dcc95a1318bd9c29a2d25ade0fb881a9597666cacb70b5fb249bcdf744
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D311C270218380AFC311CF65CDC1B6ABFE29B86204F65983DE185D7251C675E9499705
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 0417c610e5770e3de08e3f27a6132ce354b413bedc9eba632381f23ebbae40da
                                                                                                                                                                                                                        • Instruction ID: 1dcbf6391fd41f0c0a817e27e8bafbe762063cd3c7318eef4161125519cd5594
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0417c610e5770e3de08e3f27a6132ce354b413bedc9eba632381f23ebbae40da
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 57424876A083518BD724CF29C8917ABB7E2EFC5310F19892EE4C597351DB38D845CB8A
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 42edef53a1db2b3de2c06a60c4f32876a63e42617b2c0b108f141745477d7c97
                                                                                                                                                                                                                        • Instruction ID: 46ead43bd988ad5b99a16a21c2ab1060e4939541d0428d2c05e05470f57672f5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 42edef53a1db2b3de2c06a60c4f32876a63e42617b2c0b108f141745477d7c97
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2C52E1715083458FCB14CF18C0806AABFE1FF89305F18897EE8996B391D778E949CB89
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 23751e459ccc9bb6a4f1f3a1e8208e8d277617bd75432395b0e424f8c0ad6651
                                                                                                                                                                                                                        • Instruction ID: 42a8754500a030df467a19eb208a6b75f213c456a02a9d9f5179d7aa03d033db
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 23751e459ccc9bb6a4f1f3a1e8208e8d277617bd75432395b0e424f8c0ad6651
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B952E3B0A08B949FE730CB24C4843A7BBE1AB91314F15483FD5D756BC2C27DB9958B0A
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: dbc0620a8ce2ba57e9d910984acef19c89c6c78f1b9d7e948e49654559093e9b
                                                                                                                                                                                                                        • Instruction ID: ad15942890804f712327b10894ef7f690075c6ee88b13ce42d5f41658563e12b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dbc0620a8ce2ba57e9d910984acef19c89c6c78f1b9d7e948e49654559093e9b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9F52C3B0908B848FE773DB24C4887E7BBE5AF81314F14492ED6E606BC2C37AA585D745
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 83213a2729f592a7edcd98fc7886bfd8d55118cdf426f5e19ae94b324be42bba
                                                                                                                                                                                                                        • Instruction ID: 7b72874d185f9504f09fa30b763c2e13130ca022e31a023e0d3144396e745bed
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 83213a2729f592a7edcd98fc7886bfd8d55118cdf426f5e19ae94b324be42bba
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1012A372A0C7118BD725DE18D8806ABB3E1BFC4315F19893ED986A7385D738B8518B87
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 83213a2729f592a7edcd98fc7886bfd8d55118cdf426f5e19ae94b324be42bba
                                                                                                                                                                                                                        • Instruction ID: 68558444482225c7955c0e600b11cbd9586f13ed94c99baba6dc51a21589168f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 83213a2729f592a7edcd98fc7886bfd8d55118cdf426f5e19ae94b324be42bba
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1112B432A087118BC736DF18D8806FBF3E1EFC4319F19892DD9869B295D734A851DB46
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: c09ab01705470a57d5ac0deba44fab8d122be945ed84d36d91023274058ae07e
                                                                                                                                                                                                                        • Instruction ID: 819cfa75d40707277b7651a3d059055683ccfe715dfab14305db8651ec0ec7a0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c09ab01705470a57d5ac0deba44fab8d122be945ed84d36d91023274058ae07e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8C32E6B5A04B408FD714DF38C5953AABBE1AF45310F188A3ED5EB873D2E638A445CB06
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: a7ebcab429d69887af0994e9597e2f97a4cbfb516015e6b5ad3962d1502a690c
                                                                                                                                                                                                                        • Instruction ID: ef597c35ae3dd7255ed31075bc52a65a4cf46f5b29e82bd1a323442765a84521
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a7ebcab429d69887af0994e9597e2f97a4cbfb516015e6b5ad3962d1502a690c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DD32D6B1A04B408FD715DF38C8957AEBBE2AF45310F188A6DD4EF87392E635A405DB02
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 5aa5d3a12128a26ed9c4319b3588af040b5452ee3ad61b5c13934a671167d9a8
                                                                                                                                                                                                                        • Instruction ID: 1c03f4d1d9da4e588b7eb0090f71902aa376377d07fc1d7850242e2290c7d787
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5aa5d3a12128a26ed9c4319b3588af040b5452ee3ad61b5c13934a671167d9a8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 02322470914B118FC328CF29C68052ABBF5BF85711B604A2ED697A7F90D73AF945CB18
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: d327358085ba1a993c9adccc0f3e0ff780f208ec349b024e73061d52e6553d9c
                                                                                                                                                                                                                        • Instruction ID: 33820e3ec61b6ed27935afc0ea61c60b2c02f798fe3b7b14a77a253383f2972e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d327358085ba1a993c9adccc0f3e0ff780f208ec349b024e73061d52e6553d9c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DC322570914B118FC37ACF29C5906AABBF1BF45610BA04A2ED6A787F91D736F444EB10
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 7d4a608daa09243b0b1664d6ac314f1ff4fa7c4c8c111b79aec593db6438873e
                                                                                                                                                                                                                        • Instruction ID: ba4386b7c12eba82c1b0c1a845e92ae21c1426ac82d7aa641ba094e7d1c8bfda
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7d4a608daa09243b0b1664d6ac314f1ff4fa7c4c8c111b79aec593db6438873e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FE021671A083128BC724CF28C4A16ABB7F1EFE5350F19852DE8C99B351E7389D85C786
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 7d4a608daa09243b0b1664d6ac314f1ff4fa7c4c8c111b79aec593db6438873e
                                                                                                                                                                                                                        • Instruction ID: 3d25f43631a090a8bab6298e9938710fb92f8cc726097109d97d4c54c7dd1017
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7d4a608daa09243b0b1664d6ac314f1ff4fa7c4c8c111b79aec593db6438873e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B20225B1A083128BC724CF28C4916AFB7F1EFD4714F29992CE8C99B351E7389945D786
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 2253fead0949c94e28b23ae243de764efe372f7ce01ce19a162629ea64ece33e
                                                                                                                                                                                                                        • Instruction ID: 8cc232c379ab24ad0e8e110b9e0577a2d66b898ca13c535210c4519ca42de900
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2253fead0949c94e28b23ae243de764efe372f7ce01ce19a162629ea64ece33e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: ACF12771E003258BCF24CF58C8516ABB7B2FF95314F198199D896AF355E7389C41CB94
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: e82c242e154504476aa0c4a283c83f7abe834146c9a10b5b44774a429600f0af
                                                                                                                                                                                                                        • Instruction ID: 45cd01462082a999be3c825d3f843066862601c8a77bfa13494b0b085ce7d9c2
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e82c242e154504476aa0c4a283c83f7abe834146c9a10b5b44774a429600f0af
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 33F145B1E013298BCF25CF58C8517AAB7B2FF85324F198198D896BF755E7349801CB90
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: a69080f6ad1e69bdb89b54cb009ba2c83e518309b21ccd4fa82cf12907931cd9
                                                                                                                                                                                                                        • Instruction ID: bb9b723667839a33c3fd076cb6daf547bf5b8942c047ca41cb9a19f1e1e822b5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a69080f6ad1e69bdb89b54cb009ba2c83e518309b21ccd4fa82cf12907931cd9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A3F1CC356087418FD724CF29C88066BFBE2EFD9300F08882EE5D597391E679E944CB96
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 76f7eb2ea2dd7941e95dbf1f07b72685953879e74b7f78573d97f49de11c20aa
                                                                                                                                                                                                                        • Instruction ID: 9672947882af7301ed81850e948c29ad4219b15963c5e6b5008365bbf32e6af7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 76f7eb2ea2dd7941e95dbf1f07b72685953879e74b7f78573d97f49de11c20aa
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F5F1BC356087418FC725CF29C880AABFBE6EFD8304F48982DE5D587351E636E845CB92
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 192639fd68e41961d56c7569aed4b7f81ce7132f9cadfac3666f8de3caf69050
                                                                                                                                                                                                                        • Instruction ID: 6af0af9fd07dbea0327a8a302486079f3e258e751aa577ffaaa1b30c4ee5c47c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 192639fd68e41961d56c7569aed4b7f81ce7132f9cadfac3666f8de3caf69050
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5B129D61608BC28ED315CA3C8848756BFD16BA6228F1CC79DD0F94B3D3C27A9546C7A2
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 192639fd68e41961d56c7569aed4b7f81ce7132f9cadfac3666f8de3caf69050
                                                                                                                                                                                                                        • Instruction ID: 5da5253db496d7463dd8488aaaa10a3f90ca1c9a65331c8136b8e18d9d594e99
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 192639fd68e41961d56c7569aed4b7f81ce7132f9cadfac3666f8de3caf69050
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E2127C61608BC28ED315CB3C8848756BFD26BA6224F1CC79DD0F94B7D3C27A9546C7A2
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: e201d641cfe25c641c2468e7a3483f4a9060aee4472faa5ea81c6e7fcc7eb0d8
                                                                                                                                                                                                                        • Instruction ID: 473c7c0e01890161c42436878ad5ddc7d20691f55e5b146572409273c410520a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e201d641cfe25c641c2468e7a3483f4a9060aee4472faa5ea81c6e7fcc7eb0d8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CAD1F575609700DBD3209F15D8417EBB3A5FFD6354F184A6EE8C98B391EB389840C79A
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 1cec13f25c1f28221c4ff8f3f288699f7ddc068973911e15d4e3164317524c23
                                                                                                                                                                                                                        • Instruction ID: b9428077dbd98e1d6e8be41fbe90ee4c5c53a1fd51a8574cf5242cbd3ad3c060
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1cec13f25c1f28221c4ff8f3f288699f7ddc068973911e15d4e3164317524c23
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C3B177B66447509FD3268B99C884ABFB7D3FB86310F2D993DC9C2A7211C3309840979A
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InitializeThunk
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2994545307-0
                                                                                                                                                                                                                        • Opcode ID: acc099de19a44bf00ce16e18c4be42564cbb2e2978226dbcdc14d31531569d8c
                                                                                                                                                                                                                        • Instruction ID: 0d04b2c2fa50837e9638c4fbed55210e4b06bf37a5b46dbaee5e4e245b9bea77
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: acc099de19a44bf00ce16e18c4be42564cbb2e2978226dbcdc14d31531569d8c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 91B15C717043614BEB18DF24E85266B77A2EB81304F5AC53EE8859B386D63CDC09C79A
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 91e403f7bf2fe428c8ff2ae1696841098b740060b83e87f0c1d5348c1599076f
                                                                                                                                                                                                                        • Instruction ID: 7ab310dcba25bf5a8450abd58f2fba0ab2ea5301f8b6b3f60ca81adca91fd915
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 91e403f7bf2fe428c8ff2ae1696841098b740060b83e87f0c1d5348c1599076f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 25B169B1A053414BEB19CF28E8516BBB7EAEF81314F09C53DE8858B381D736D849E791
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 918cd65cbadabd6da86d83a30b2b2da0488193a68d8c3fca759c00fcea01beb3
                                                                                                                                                                                                                        • Instruction ID: c845803a38f6c77acddbfa9eef1216980ece3764384c33bb2f9187d8778c445e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 918cd65cbadabd6da86d83a30b2b2da0488193a68d8c3fca759c00fcea01beb3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2BF1C0F0904B40AFC3A5CF3AC942797BEECEB0A360F14491EF5AEC2241D73561458BA6
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 918cd65cbadabd6da86d83a30b2b2da0488193a68d8c3fca759c00fcea01beb3
                                                                                                                                                                                                                        • Instruction ID: dd0999f5c427c1fd8a3562c4e24898138509209533d8f0cdecc82409eaa535a7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 918cd65cbadabd6da86d83a30b2b2da0488193a68d8c3fca759c00fcea01beb3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 56F1CFF0914B40AFC3A5CF3AC946797BEECEB0A260F10491EF5AEC3641D73165459BA2
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 455de48da1b395ee01d158247e6300201ea3688789ea299f7cc6c50f6c6940d8
                                                                                                                                                                                                                        • Instruction ID: 41c3e091da67547de47b3906f8a28cdcf4f9a35dde57214a1a091a27875e02c3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 455de48da1b395ee01d158247e6300201ea3688789ea299f7cc6c50f6c6940d8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F0024861508BC18ED3268B3C8848A56BFD26BA6224F0DC79DD4E94F7E3C279D506C762
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 455de48da1b395ee01d158247e6300201ea3688789ea299f7cc6c50f6c6940d8
                                                                                                                                                                                                                        • Instruction ID: 71b9ec4e982a84b2a3c141e01712e0d5c6053dc1ffed0307ef2ec500faefb6ca
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 455de48da1b395ee01d158247e6300201ea3688789ea299f7cc6c50f6c6940d8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 15022761508BC18ED3268B3C8848A16BFD26B66224F1EC79CD4E94F7E3C679D506C762
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 53eb30f04210c5aa1d7ea8e5a987f3c65e47ecdc85497fc231301112acc4fb82
                                                                                                                                                                                                                        • Instruction ID: 8f62d820d698011493e9b4d33d56c28701bf8a730f1a894cccb9041d930e3295
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 53eb30f04210c5aa1d7ea8e5a987f3c65e47ecdc85497fc231301112acc4fb82
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A4B148B5E00565CFCF10CF59E8417AEB7B1AF0A304F5A407AD899AB342D7399D01CBA9
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InitializeThunk
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2994545307-0
                                                                                                                                                                                                                        • Opcode ID: 78baf6bead69bc787f6e498b6209c58df4768a7a1f3029cd250c3ec1940b1aee
                                                                                                                                                                                                                        • Instruction ID: 3d8e549ead381eb5a41ee94ce64dad1362128fe91ea456cb5e2966e39e4c66ca
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 78baf6bead69bc787f6e498b6209c58df4768a7a1f3029cd250c3ec1940b1aee
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A3B12536A083129BC724CF28C88056BB7E2FF99700F19953DEA8697366E735DC06D785
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 43a38f77119da688ac3ac81b48a3df6363d837cca15ab4ad9599a2e3d82993cc
                                                                                                                                                                                                                        • Instruction ID: b144b6dd79ea436e968c42c60b3126bad089d884c972f77a7c5af8576dd6a27c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 43a38f77119da688ac3ac81b48a3df6363d837cca15ab4ad9599a2e3d82993cc
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 45B12532A183128FCB25CF28C48456BB7E2FF89704F19852DEAD69B765D7319C81E781
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 98cb35be4dcf6147bb54d841e08aa9a7e406920ae8f199def00657b733b42f8a
                                                                                                                                                                                                                        • Instruction ID: 8a51dd8e2965cc9f0c4013a2f6a7698077ed2e8ce9dcff126952d1e9ceec8530
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 98cb35be4dcf6147bb54d841e08aa9a7e406920ae8f199def00657b733b42f8a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EFB15579904301AFDB108F25DC41B5ABBE2BFD8314F144A3EF898932A1D776DD668B06
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 3c637dafc4c5c02bba21bf8384fb5f02d2acdfb7e2cfb5a4e70ebd11587584d3
                                                                                                                                                                                                                        • Instruction ID: 735c4c0247dde7533511de94161505db0b3cfd0a2265894a2e9a1e8cf245c955
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3c637dafc4c5c02bba21bf8384fb5f02d2acdfb7e2cfb5a4e70ebd11587584d3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9DB1C1B2508301AFDB51AF24DC44B5EBBE2FF94754F244A2CF498932A0D7729915EF42
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 1235eeb8cf710a390d5557258a43f903d8b0ebafe0fc0a19c3d367544ede0ca8
                                                                                                                                                                                                                        • Instruction ID: a24f2a78553098ad8a5e3b5bc8abd089333314a4ae9ebed43d08ec28266042c4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1235eeb8cf710a390d5557258a43f903d8b0ebafe0fc0a19c3d367544ede0ca8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9D9126B1B04321ABD7209F20DD91B77B3A5EF91318F14482DE9869B381E7B9E904C75A
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: dd71efafbe3cc21deb18af7b1feb0adcacd6565e9113104d404282071b8f505b
                                                                                                                                                                                                                        • Instruction ID: b87f2483bd14e23bbf83894e831bfb64d4422bf2018dcde281cd4833533360f7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dd71efafbe3cc21deb18af7b1feb0adcacd6565e9113104d404282071b8f505b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DF9102B2A053019FD7259F24C8A1B6BB3F5EF81718F08482CE9869B391E775EC04D796
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: d66196a234f06480f41816911af9b4ea699047e9e12ae4b8e975acb0d7698cc7
                                                                                                                                                                                                                        • Instruction ID: f950459b000a7738c455c7355856e33f032d1fcb9525e83dbd6c998b243a90d7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d66196a234f06480f41816911af9b4ea699047e9e12ae4b8e975acb0d7698cc7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 92A1F5729143118BC324CF24C8916ABF7E1FFD4754F2A8A2DE8C59B764E7349941DB82
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InitializeThunk
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2994545307-0
                                                                                                                                                                                                                        • Opcode ID: 69f7ea7b3bcfd880a0eef8db25e79bddcc6229897a0f740fc9fa50f79ffe9049
                                                                                                                                                                                                                        • Instruction ID: 3187122ed07642cbe4dcf9e03264eeaa439871456ea8a6719abbd84e200541cd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 69f7ea7b3bcfd880a0eef8db25e79bddcc6229897a0f740fc9fa50f79ffe9049
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4EA11436A043018BC718DF28D99092BB3F2EBC9710F1A957DE9869B365EB35DC05CB46
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 73df037b7ed471f27b11ebbe38ccb4fbfbef165bc0754b8ed2e20a33442e0b7b
                                                                                                                                                                                                                        • Instruction ID: 242ca7f67c518de47014e6f55308b5274876ce9256ba8ed270b299b4a0647418
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 73df037b7ed471f27b11ebbe38ccb4fbfbef165bc0754b8ed2e20a33442e0b7b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 20A1D2766043028FCB15DF28C89496AB3E2FFD5714F1A856CEA868B754EB31DC81EB41
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: bc4bfdbd75c94b69f0a0099a9aec3f3e1abf52cef7a5ad0f4f638173c0b64b08
                                                                                                                                                                                                                        • Instruction ID: afe5d4654f5e8657962bc42cc500043a3620e9a043509faccf93fb76782c58a6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bc4bfdbd75c94b69f0a0099a9aec3f3e1abf52cef7a5ad0f4f638173c0b64b08
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DBC15BB29087418FC360CF28DC96BABB7F1BF85318F09492DD1DAD6242E778A155CB46
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: bc4bfdbd75c94b69f0a0099a9aec3f3e1abf52cef7a5ad0f4f638173c0b64b08
                                                                                                                                                                                                                        • Instruction ID: ac20cda617325f53743baee8b63eaf52ddcfc77b99e143504e6cd3ec8ec76ac9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bc4bfdbd75c94b69f0a0099a9aec3f3e1abf52cef7a5ad0f4f638173c0b64b08
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 07C18BB2A087418FC375CF68CC86BABB7E5BF85318F08492DD1D9C6242E779A155CB06
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: eca7b8087cccba19e5979cf0e8330dd1936bd6a3fecaafeec36cf51b3ab145d2
                                                                                                                                                                                                                        • Instruction ID: 652f8e9b795bdad566c10a3835dfc4d237c9f110778e3a4e594c84154d78986c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: eca7b8087cccba19e5979cf0e8330dd1936bd6a3fecaafeec36cf51b3ab145d2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 43914C72754B1A4BC714DE6CDC9066EB6D2ABD4210F4D423CD8958B3C2EF78AD0587C5
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 6c996c3f4605880eb5795293c8fc84fa0ba55b563aa94cfbc2b65958c9b9224e
                                                                                                                                                                                                                        • Instruction ID: 89cd8c3f6ac805753dcfa7ea52abb159a623b373aaffce4ab273b97bd3830c78
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6c996c3f4605880eb5795293c8fc84fa0ba55b563aa94cfbc2b65958c9b9224e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CFB10575608790DFD714DF24E891A2BB7E2EF8A314F488A6DF0D5872A2D7388905CB16
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InitializeThunk
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2994545307-0
                                                                                                                                                                                                                        • Opcode ID: 7757ad35b4d3f19014e5b0218f9aa537273a9f10abc5234e4bd6fc32e4c2e1b2
                                                                                                                                                                                                                        • Instruction ID: cf6a0fb400f3c0121e69896af41eb3d2a2b4280c5d577effd33442f2baf9bc8c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7757ad35b4d3f19014e5b0218f9aa537273a9f10abc5234e4bd6fc32e4c2e1b2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CB81AE326053019BC7249F29C85067FB3A2FFC8710F2AD42DE9868B395EB349C52D785
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 2bb226d847c6d85160f6813aeae79ffa1446c0b5c4b11e29441bf99546017c60
                                                                                                                                                                                                                        • Instruction ID: 50ca43cf46bb55de3b3108707d0978231ada38f0b11b36ecb8a49fbf00f6224e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2bb226d847c6d85160f6813aeae79ffa1446c0b5c4b11e29441bf99546017c60
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 00815B36A043065FCB159F28C854A7BB7E2FFC4710F1A856CE9878B654EB319891E781
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InitializeThunk
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2994545307-0
                                                                                                                                                                                                                        • Opcode ID: 28138e8c65325f641ce846c5d717fbfcd9e0028e0a671fa80ee9e5ed8af67cde
                                                                                                                                                                                                                        • Instruction ID: ba880319810bdb8e213e259538359e713a98a4b2945b2457ae3d4c78796ecc2a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 28138e8c65325f641ce846c5d717fbfcd9e0028e0a671fa80ee9e5ed8af67cde
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 47512A357043008FE7188F28C89577BB7E2EB9A320F18A62ED5D597392D7389C41C78A
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: b868a3013f37864ed973b3668e501d643bc9a4679fe388745f9f5cf196745faa
                                                                                                                                                                                                                        • Instruction ID: 33bf206e5c53e1c880bc7eafb6cd1ca0ed9bea4ab3c2e50166078e1c9b43f19a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b868a3013f37864ed973b3668e501d643bc9a4679fe388745f9f5cf196745faa
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 085101347083409FEB699F29C89567FB7E2FF82328F18892DD5D6932A1D7309881DB41
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 2a5610294b30e5e8a679adaf8088138694fc7c481e66a98cc5ba01ae8c02aa6d
                                                                                                                                                                                                                        • Instruction ID: c8e85d340764d3b4d6a043baf240a448254d236dbbdea7acc366692660b189d4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2a5610294b30e5e8a679adaf8088138694fc7c481e66a98cc5ba01ae8c02aa6d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C87129B2A042614FC7158E28D84139FBBD1BB95324F18863EE8B9873D2D779C84AD7C1
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 348a960796a6df68399cabf459a6c70aaca195daff6aee637ae217081242f236
                                                                                                                                                                                                                        • Instruction ID: 31b1436108e76faef3e4bfb460238a7c9d81c230e96f44867ef1bedec568b1da
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 348a960796a6df68399cabf459a6c70aaca195daff6aee637ae217081242f236
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3571F8B2A047614FC7268F28C84175EBBD2BB95264F28823DE8B9873D1D7358846E7D1
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 29143899424894e7b8e427b1e6e1f66170dacedfe65da3d43b0f1d8a79b00b20
                                                                                                                                                                                                                        • Instruction ID: 4c2c0ab1878e9cfa13c7d80eb19278cb3d77386feaf759a830bf0c171a5c4840
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 29143899424894e7b8e427b1e6e1f66170dacedfe65da3d43b0f1d8a79b00b20
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3C613B3A7496C047D3288E3D4C112AABA934BD7230F2CC77EEDF6873E1D56988469355
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 29143899424894e7b8e427b1e6e1f66170dacedfe65da3d43b0f1d8a79b00b20
                                                                                                                                                                                                                        • Instruction ID: 24f73a2dde0160871e1f94430af2e554cba39ddbac1a6f62132c67e8dcaa82c7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 29143899424894e7b8e427b1e6e1f66170dacedfe65da3d43b0f1d8a79b00b20
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 70612166749BC04BD3298F3C8C612AEBA934BD2234F2CCB7DE5B58B3E2D56588059301
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 93ce565895c2d767d3f4f3cf703cee2db26bdababecfc0e7e91b354ce90ac481
                                                                                                                                                                                                                        • Instruction ID: 19c9bc1ea9186e56c23c5e66cc144f5345884b6a785bfb5c303e44cb60fc86fa
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 93ce565895c2d767d3f4f3cf703cee2db26bdababecfc0e7e91b354ce90ac481
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 915126746083009BE7109F29DC45B2BB7E6EB89704F14982DF5C597292DB39DC05CBAB
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 0288cd3b192f347070e81ea7353e08bb5565fcf5553c08da131d7bc18d8c1a13
                                                                                                                                                                                                                        • Instruction ID: 583c87d3fd9d435e842b0babbfef0573c90b7f3422fd301491a952917507ab78
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0288cd3b192f347070e81ea7353e08bb5565fcf5553c08da131d7bc18d8c1a13
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2E516DB15087549FE314DF29D49435BBBE1BBC8318F044E2EE4E987390E379DA088B96
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 0288cd3b192f347070e81ea7353e08bb5565fcf5553c08da131d7bc18d8c1a13
                                                                                                                                                                                                                        • Instruction ID: 323f9113a93875d373960a60de761bb91259e24cc9ef0f53005055ce175423fb
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0288cd3b192f347070e81ea7353e08bb5565fcf5553c08da131d7bc18d8c1a13
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 20515CB15087548FE714DF29D89435BFBE1BB88314F144A2DE5EA87350E379D6488F82
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: fb453cfe87c3d4895fcef5adcba70af742de5fc44f30238646acffd3f92754e0
                                                                                                                                                                                                                        • Instruction ID: 6e37d88637f30dcf1ca5a39760ca9fc235c391d288c19f204446c63a880f3ae7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fb453cfe87c3d4895fcef5adcba70af742de5fc44f30238646acffd3f92754e0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0951AE30B483648FD710DA28A480267BBD2DF95320F8A867ED4D44B3D6E67DD90DD389
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 516e6924cf22855bcc51b03261ade72ba20a7268c254d95cb2793a6fa0abd341
                                                                                                                                                                                                                        • Instruction ID: ffaf23848fac15143084a530eafd2bb9d19a0748c35a664ec89cf513e14ac34b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 516e6924cf22855bcc51b03261ade72ba20a7268c254d95cb2793a6fa0abd341
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0D51AE71A8A3458FD7218F2898802B6BBD6DF85324F0D877CD5A04B7D2D3369509EB81
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: d04a0d8e38c3f294c211cbf0a89a7ee30207864e8a9f5169d07d9085582a6937
                                                                                                                                                                                                                        • Instruction ID: 1e023c5d0ae8bc499a1476ddf9e588c272e9bef8a9d0e355e0d1dc09bced5273
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d04a0d8e38c3f294c211cbf0a89a7ee30207864e8a9f5169d07d9085582a6937
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 03615C31D046A18FDB14CF28C85039DBBF1AB4E310F1AC6AAC859AB391C7799C45DF85
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 4f6158e6fd38aad5bf6509a71069262e40ef65b1444f80fe14b24d050b94fc1b
                                                                                                                                                                                                                        • Instruction ID: 8ce400d68dd3fed01092670ba875c0fc71aeaff33e0ecfb1719a1bd54c4cd7f8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4f6158e6fd38aad5bf6509a71069262e40ef65b1444f80fe14b24d050b94fc1b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4D51F337A126158BD72CCB29CC51AAE3693EBC5314B6FC6ADC852A72E4CF355C01DB84
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 14e37fb932aedb11fa387dd9939253c0f7ff1ad23df96d2736cdcaf972ad2bbb
                                                                                                                                                                                                                        • Instruction ID: 7e6af92b3465838b87b03a8535f70c08a3d30903058d1bc4ba0583f1943f22e8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 14e37fb932aedb11fa387dd9939253c0f7ff1ad23df96d2736cdcaf972ad2bbb
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 02615A32D047A08FDB15CF38D85039DBBF2AF5A310F0986A9D85AAB391C7759C85DB81
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: d6b1564bfa2ad103e6c8e4ea998856fae83061142c01d468a44387b6357ebff0
                                                                                                                                                                                                                        • Instruction ID: 9fd21c52bf3f29132c5d99d404501be180c63ee0c093d75c725f57d12f0d7a53
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d6b1564bfa2ad103e6c8e4ea998856fae83061142c01d468a44387b6357ebff0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4A5105B29083419FC725CF28C8917AEBBE2AFD5304F68892DE0D9D7291D634E845DF42
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 1ef048c84a4d0d30155c60ee93ead0c638561ed7b80bb9c5424c616a3cae521d
                                                                                                                                                                                                                        • Instruction ID: 11ac807350052b856cad365f6779d078452651dc07503d8ad66b9ab83d282002
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1ef048c84a4d0d30155c60ee93ead0c638561ed7b80bb9c5424c616a3cae521d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E54189B6E543119BD3B55B08CC41B3E77A2F791708F29852CE941AB2A6C7709E00BAC5
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 5d40f3589d6db934739ebf9594a1d5e282e52d6bab2cc16f230a3767b41ee887
                                                                                                                                                                                                                        • Instruction ID: 436747c3d0115335d64e3fa0e8e61ad8fdc9212a222e16a439e62af10e3af1e5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5d40f3589d6db934739ebf9594a1d5e282e52d6bab2cc16f230a3767b41ee887
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 594128B66083058BD711AF14DC5097EB7E2FF95308F29453CE5A993261D7318E06BB81
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 80a270cec9775b927bc727ae391425bd2de1f56668aa53b1f5ee410799ab9563
                                                                                                                                                                                                                        • Instruction ID: d4e59386902d7f076a599dd24da1785c797e999f3f2e44946b1e4a57c50fb419
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 80a270cec9775b927bc727ae391425bd2de1f56668aa53b1f5ee410799ab9563
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 13319B33BA87504BD304DB628C886ABE586AFD1764F0D466DE8D4773D2C9B49C0183DD
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 80a270cec9775b927bc727ae391425bd2de1f56668aa53b1f5ee410799ab9563
                                                                                                                                                                                                                        • Instruction ID: 7a1ee169b2fc11927a0ae62116f720ab42cd7a4fd8399e214d77eacd3a79fd91
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 80a270cec9775b927bc727ae391425bd2de1f56668aa53b1f5ee410799ab9563
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D731D133BA83904BD355DB518C88AEEE5DB9FC1724F0D454CD8D5A77A1CA709801CB99
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 650eb172e118ef885b582a1f2118d399d062a96475d7e344e0e0ea62cb8c0cfa
                                                                                                                                                                                                                        • Instruction ID: 0d2d34369dae2a22da100cd6d400a2fe056f01ec5506a5fdf441aaa8518b25a7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 650eb172e118ef885b582a1f2118d399d062a96475d7e344e0e0ea62cb8c0cfa
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 263168B6504341EFEB258FA4C880E7EFBA6FB85310F29942DD98527131C7319941EB86
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 01c010b77cb3c6354ab597c6acc6aaa608f20e90445c07501ea0d45f4b435f52
                                                                                                                                                                                                                        • Instruction ID: 19baddd1754055bf72226713221967ac3d35ee3dc8c286b21355d6d812870676
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 01c010b77cb3c6354ab597c6acc6aaa608f20e90445c07501ea0d45f4b435f52
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 283126BEA083218BD3619B08DC4067E77A2ABD5318F7E852CCCC5A7311D7316D01EAC1
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 699edd7276c8ad0d309fdbde42b95b82db78e11e2160b820c2e1cb96630937e1
                                                                                                                                                                                                                        • Instruction ID: 0a7c748a8cd989ac34059585cd318d51e9e43ebd593a46ec61bc5e8abfaa4ad1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 699edd7276c8ad0d309fdbde42b95b82db78e11e2160b820c2e1cb96630937e1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B2411773E106218BD719CF69CC516BE76A3ABC531475E82ACC861EB395DB359C02CBC0
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 7e079517465845483c92d3a324a13df3ad619da0cd9ef97a3afcc48b4d234617
                                                                                                                                                                                                                        • Instruction ID: 32b0c584142f7a626a36e57f53f565b3fec3f96cb0f3515f4eec0e697a9f6dc3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7e079517465845483c92d3a324a13df3ad619da0cd9ef97a3afcc48b4d234617
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 22318D32A01723CB8721CF5CC8C05EEB3B2FF897403A68569D941AB274DB306D64E694
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 70a5542dbed4291c7f0e4c69363a5fae7bd86cdcdd8d89fd126e446a51f24cc8
                                                                                                                                                                                                                        • Instruction ID: f52b03c38bbf71025152a8b77a79184c4a140196803d3bef29f19ac7e076952c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 70a5542dbed4291c7f0e4c69363a5fae7bd86cdcdd8d89fd126e446a51f24cc8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2241D2B1E102285FDB24CF788C5279EBAB6EB95300F1181BDD849EB285E7340D468F92
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 70a5542dbed4291c7f0e4c69363a5fae7bd86cdcdd8d89fd126e446a51f24cc8
                                                                                                                                                                                                                        • Instruction ID: 2220a634ce413cb09d9e00aeb7c177c041afb85b7cd0226ba669feb07c109d38
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 70a5542dbed4291c7f0e4c69363a5fae7bd86cdcdd8d89fd126e446a51f24cc8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4141B1B1E103285BDB24CF788C5279EBAB6EB95300F1581ADD859EB285E7340D468F92
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: e42cdc780338998972cb1cbc14932b8cb1ea3de4fce98a2356dd7462f473f1f4
                                                                                                                                                                                                                        • Instruction ID: 0222f60484ab411d992a969a4a44cf0663a6e11289f5ed28938beab07bfcb2c3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e42cdc780338998972cb1cbc14932b8cb1ea3de4fce98a2356dd7462f473f1f4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 503124B15043408BC3309F28C845BABB7E6EFC2365F548A1CD4D5AB391EB349801D752
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 6719c340687af9c7671d69fd13b02110751ddfc4bfd7c22202d719cfaa6f9092
                                                                                                                                                                                                                        • Instruction ID: f5f621b67306c00f1b1f1892e0c4b111cdc11732c84e43f9357b9df5953cc386
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6719c340687af9c7671d69fd13b02110751ddfc4bfd7c22202d719cfaa6f9092
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3E7160B840AB848FE774DF04D45868ABBE0FB8A358F52991ED48C47311C7B92448CF9B
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 43ed2d0cd7e23cb56a2031a010359021465c5d9ae3fc3a1ff7632189df559008
                                                                                                                                                                                                                        • Instruction ID: 31cf7e3db1c8924ca0313fd67284a6f41b4e10e60bb25c271fb1194773331285
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 43ed2d0cd7e23cb56a2031a010359021465c5d9ae3fc3a1ff7632189df559008
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 573146B6A483009FD3208BA8C884BBFB7E7A7C5310F3C953DD5C597255CB3598819786
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 3ac257c9c1b75187117c336eb7496787fabe20a4f9f742b947e5c359f3d43b3c
                                                                                                                                                                                                                        • Instruction ID: 24e83879a734b152f463eb7ca99c156da8292c87067313e83d08c5c08021f5dd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3ac257c9c1b75187117c336eb7496787fabe20a4f9f742b947e5c359f3d43b3c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6421F831E083500BD718CF39989116BFBD29BDF224F18D53DD4A697395CA38ED068A49
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 1bd5c86e3cd12e28ed28727b1f2d063bfe7e67913eaebacecbba6bc732c4744b
                                                                                                                                                                                                                        • Instruction ID: f299bbde0235f3a7923e6bd1bd80f84f4645a8d06b05ad3fa796e7613e882aae
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1bd5c86e3cd12e28ed28727b1f2d063bfe7e67913eaebacecbba6bc732c4744b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E01157B82093429FCB58CF24E88097E73E2FF46308F14693CE1819B269D736D945EB16
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: bd0ee31e4d4d6d9ac2fa2587f77cf37721911ca3e59ccc36e7bfb755614f87b6
                                                                                                                                                                                                                        • Instruction ID: 2e66319cfaede8187dee7502eb2bdf6532bbee011b37898b3e62ff9ec94ea10c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bd0ee31e4d4d6d9ac2fa2587f77cf37721911ca3e59ccc36e7bfb755614f87b6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2C1166324092905AC314CB289940737BBE19B87310F584A5DF4D6E32E1D728CC028B8A
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 57a1d6dc959a99ffce52465f3ced87fece6d02db5f489f15dd164950e6412c6f
                                                                                                                                                                                                                        • Instruction ID: 1e0c74346f3cd0cd8cacc9c0c10c0cc1f2dba9767f3511247c0f9d10f6e24b1f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 57a1d6dc959a99ffce52465f3ced87fece6d02db5f489f15dd164950e6412c6f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6C2102BAA443509BC3158F48D8815BFB7E2EB91308F69843CE88967211C735ED05BBD5
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 4f9a145d1016b4b0f711bdeb502ec5b34ea66807830c0b234bdd3adf214441fd
                                                                                                                                                                                                                        • Instruction ID: e3cfd10a67b93457c067fc47182d6ce90ef192e9cb1044a0f68adeb83ff2520a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4f9a145d1016b4b0f711bdeb502ec5b34ea66807830c0b234bdd3adf214441fd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D71186324093A05BD325CB29D94073EBBE19B97610F684A5DF8DAE33E1D724CC02D702
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: f1935557e2f2806b9940cce5b2d267874e1034516f04e5d51b8115aeefe7cdf9
                                                                                                                                                                                                                        • Instruction ID: 6d26dbb42118e9ac837d807bbe9fb45e7e9e3e100dfe127476273a623093095b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f1935557e2f2806b9940cce5b2d267874e1034516f04e5d51b8115aeefe7cdf9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 631127B2B0979147E72DCE3984613BBBAE2ABC6314F2DC57DC4C697249DB3984018749
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 4a164414c649293df32a122712d6e0e106fe21d8b546922be5564c9c7b9508f0
                                                                                                                                                                                                                        • Instruction ID: 603913e0b33f28c492f51c7d74a1a6b29ccd81972a7ba8fe453e19092e09cc83
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4a164414c649293df32a122712d6e0e106fe21d8b546922be5564c9c7b9508f0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A20149746083015FEB519F249985A3BB3E7ABC6304F18D438D586931A1D731CC82A716
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
                                                                                                                                                                                                                        • Instruction ID: 1bdb52c757136d0f491bb15e4131204bafb517a34a554dccf387603b88e59a22
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4D11EC336055D40EC3198D3C84006657FD31AB7235F6953DAF4B89B2D3D5268DCA8359
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
                                                                                                                                                                                                                        • Instruction ID: feee3c2d0f8dda6270a1c4e4f8d194412eb579bffa2e4626da0ddc6a95cba855
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8411C633B052D04EC7268D3C9C00569BFE30A93179B994799E4F99B2D2D72389CAA761
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: b077483ebbe41559666eb24632921f170fd341de44e0cb4593afb61e9b0962fb
                                                                                                                                                                                                                        • Instruction ID: 3de76f9d274b52e90d2ef9e87ec8d3366dafd7d2e10265ff4f1f4711345407d1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b077483ebbe41559666eb24632921f170fd341de44e0cb4593afb61e9b0962fb
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7601B1F570171147D720AE51A9C0B27B2B86FC0748F19443EEC4457342DB7DEC29869E
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: e4a6bce38bb77cb855b0c1b2651f63ca23977da10de64c19d828eeec774b109c
                                                                                                                                                                                                                        • Instruction ID: fafa99c03bbd9fd39945343d471196f6ae06893a7de7caaf8fe723b46cdd6e08
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e4a6bce38bb77cb855b0c1b2651f63ca23977da10de64c19d828eeec774b109c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5601B1F1B027018BDB229F1084C0B77F7E96F80704F19443CD9495B200EB72E815AAA1
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
                                                                                                                                                                                                                        • Instruction ID: ae801a88314c073f9ce041e53d5c6a4f1ccaa872c9aa568154bc63fafd5e974a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0201A276A107048FDF33CF24C805BEB33E6FF86216F4545B5D91A97281E774A9418B90
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 7d6529698e20a6c769e7980251b0ca5e132cff0518f497c1ab8b00d6e4c79072
                                                                                                                                                                                                                        • Instruction ID: 34e981112378c59cf45707eac27e4188cbaca79d234523b47ecff1cb0040ee73
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7d6529698e20a6c769e7980251b0ca5e132cff0518f497c1ab8b00d6e4c79072
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 59016DB9C00624EFEF00AF55DC01B9E77B6AB0A324F0414A5E508BB392D731ED10CB95
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 6136a0a86494c0451f0a8cc20dd56009850612ffaa73c5348e62317f6daaf908
                                                                                                                                                                                                                        • Instruction ID: 6fe86767ae109bd37ca548fc473bb8b220effe7bf47f37b6b657c2cb10d21e5d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6136a0a86494c0451f0a8cc20dd56009850612ffaa73c5348e62317f6daaf908
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F8F07AB6D006149FDF50EB98CC41EDE77B9AF0A320F190490E509BB260D622FD549F95
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 3b41fa5205d4ae5a3fd68479d9a62f5c8f3548fe329d4af70c97534e327c91f5
                                                                                                                                                                                                                        • Instruction ID: 76115147780e5b0d0309e2a0309811062aead7e9691d40ac881d7231c88a4ab0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3b41fa5205d4ae5a3fd68479d9a62f5c8f3548fe329d4af70c97534e327c91f5
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 23E0D8FFD556600397548A235C02226B1936BDA628B1AB8788E9673707EA359C0741D8
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 7c88d2dd0d5ef8fcb1920e32d35327158bdbdf587074639a4ccac7672161239f
                                                                                                                                                                                                                        • Instruction ID: d7bd3ab2641531d64e2b5cca85a5088487767747c66937baeb242980dcd8256a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7c88d2dd0d5ef8fcb1920e32d35327158bdbdf587074639a4ccac7672161239f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E7E0DFEFE557601797188A318D40167B193ABD663172AA4748E8773705EA31AC0B85D4
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: d3e382a35f6a7edaa88fbd4097d4fd738d9cf468eed6d2bef4b4d717b7d72e8c
                                                                                                                                                                                                                        • Instruction ID: 8488e0a8640df04fcf481087a0a0e2354c4894f8e99b76394d31cfc5082ce78b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d3e382a35f6a7edaa88fbd4097d4fd738d9cf468eed6d2bef4b4d717b7d72e8c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6BE01279C11100BFDE046B11FC0161CBA72B76630BF46213AE40873232EF35A436A75D
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 03be019c7f84eab5680fd60e5a6e0a4c14760194c7c122451d5e0e1049be607d
                                                                                                                                                                                                                        • Instruction ID: 4e56df9f808fc269b79d8d42c7a54bae4b81b27f67d45ce7eaaa4965d5b8cfeb
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 03be019c7f84eab5680fd60e5a6e0a4c14760194c7c122451d5e0e1049be607d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 03E0E575C11200AFDF007B11FC00A5C7AB3BB6230AB461175E409A3230EF325AAAFB59
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 627599c8012a5de30bed4bcc5cdf041527b351da4d44e435234bf5fd0dbcc5af
                                                                                                                                                                                                                        • Instruction ID: 6ac02578ad27a7ab094e0933409bfdfb1a086e3d696aa804aad2b9e64bd792dc
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 627599c8012a5de30bed4bcc5cdf041527b351da4d44e435234bf5fd0dbcc5af
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 63D02B11809B33830F1A0D386110239A7970A0310438E019088C07F742C713C80362D4
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 9580c00f8d87a75d1cefbcc58e71a064fbff43a3de15b5db8def70aaa11ec223
                                                                                                                                                                                                                        • Instruction ID: 6e3621e5ba52bd1720ea54ad2d17b774c7841a8325dce5c8bd5a6b1d086829a3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9580c00f8d87a75d1cefbcc58e71a064fbff43a3de15b5db8def70aaa11ec223
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 36D0C279815910CBDB047F01EC0216A73F4AB03389F04007CE88123263DB39D8288E8E
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: b699e929166f3269f3c0af6cf854a66d2adcb16623502ccf6fa341cc05aeb82f
                                                                                                                                                                                                                        • Instruction ID: 1998daea66fa5cf1a59c662d2b4556dee68bbeb45ed263a3842c7ecab4098145
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b699e929166f3269f3c0af6cf854a66d2adcb16623502ccf6fa341cc05aeb82f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AAD05E72C14248AFD9409B00DC41BAAB3FAFB5A714F041524B988B10A0E622DA289B57
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 49296dab776a215db2218e93475e1eaebcd65e3db626a3e2e0a563717988ad4a
                                                                                                                                                                                                                        • Instruction ID: f6de81edf4edbd36f0565e031b671f89904ab193cb181933f1b50bd017efe36b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 49296dab776a215db2218e93475e1eaebcd65e3db626a3e2e0a563717988ad4a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C9D0127BF9210047DA099F11DD43775666393C770870DE1398805E3348DE3CD41A840E
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: a8f9aa8a7fabceb26a773c801b96314e67806ff88a01327c7cabaf7e1195b6db
                                                                                                                                                                                                                        • Instruction ID: 4bf26fc1f0141653a9503b94d050fc3b932c66a7c35cdc45f3b957a59c696b76
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a8f9aa8a7fabceb26a773c801b96314e67806ff88a01327c7cabaf7e1195b6db
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7FD0127BF821008B9A099F10DD43BB56A6397C7704B0CE134C905D3358EA3DD41A940E
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 77b0f56a3a3e1bb8ea188a0444bb5e5b9921abf6ae6ebc879750073e405f2179
                                                                                                                                                                                                                        • Instruction ID: c40df4f40b565673574f117b3b393b79a76a3f9a491c552766a49f6821d64b0d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 77b0f56a3a3e1bb8ea188a0444bb5e5b9921abf6ae6ebc879750073e405f2179
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: ACC012BCA4C10187D7088F10EC05735B636E797A01F14E125C441232A5C630A403860C
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 77b0f56a3a3e1bb8ea188a0444bb5e5b9921abf6ae6ebc879750073e405f2179
                                                                                                                                                                                                                        • Instruction ID: c40df4f40b565673574f117b3b393b79a76a3f9a491c552766a49f6821d64b0d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 77b0f56a3a3e1bb8ea188a0444bb5e5b9921abf6ae6ebc879750073e405f2179
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: ACC012BCA4C10187D7088F10EC05735B636E797A01F14E125C441232A5C630A403860C
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 341987432dce9904f649f917b7ed575f0bb4bb5c5b4e9ef9425cd867c06a6129
                                                                                                                                                                                                                        • Instruction ID: 92b7b4c9aa8be748aa5aa3e84e1a8a0a6ae0f202e8b946c14c9147e3395284d9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 341987432dce9904f649f917b7ed575f0bb4bb5c5b4e9ef9425cd867c06a6129
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 83B092A1C02D10CB94223F202C018EAB62A1D13300F846030C90626220BA27DA2A589F
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: f753dbc925eeb97c78fc90efc39af23615c529da2cdf343c0b9dd0ba408761e0
                                                                                                                                                                                                                        • Instruction ID: 177fc3cee3c348da085ae0892af531f2737600cec77009a1f2da233a7ceff2b5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f753dbc925eeb97c78fc90efc39af23615c529da2cdf343c0b9dd0ba408761e0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3DB011E0C08A00CBE800AF20AC008B2A23C8A0B220F003830C008EB222E232E8008A0E
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 11edc8d7ae4c917e56862e9043f01123a23c23558e3e2cb29e810181f8f007cd
                                                                                                                                                                                                                        • Instruction ID: 02d06448f02dd76ad61b8ab648816bdf30096f71157e536fee4757e064133957
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 11edc8d7ae4c917e56862e9043f01123a23c23558e3e2cb29e810181f8f007cd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AEA022F8C0A800C3E800CF20BC02030F23C830B2A8F00303AE00CF3203EA30E0088A0E
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: a4feeaae0c5d4225290c8f64d1143a34bd66befac27b9bcfb2494fe2660e1556
                                                                                                                                                                                                                        • Instruction ID: 5f90c8482877ae364e78efe8602c82ba5110085f469652caa7ae2d3bb2038f17
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a4feeaae0c5d4225290c8f64d1143a34bd66befac27b9bcfb2494fe2660e1556
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AC900224D4D1008681508F449440470E279930B111F103410900CF3062C310D545455D
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AllocString
                                                                                                                                                                                                                        • String ID: $#$/$0$0$4$;$B$B$G$H$J$O$Q$]$^$m$n${$~
                                                                                                                                                                                                                        • API String ID: 2525500382-534244583
                                                                                                                                                                                                                        • Opcode ID: 88941a0f473d950aaf799373c472504fdf4e728c02f445fde5d667b58de91daa
                                                                                                                                                                                                                        • Instruction ID: e2dddc40eb3f9dab4f65535c588d3d72a3f147e4bda3b82f36fbc837b78308fa
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 88941a0f473d950aaf799373c472504fdf4e728c02f445fde5d667b58de91daa
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8481066010CBC28AD322C63C881875FBFD15BE7224F184B9DE1F58B3E6D6A98146C767
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AllocString
                                                                                                                                                                                                                        • String ID: $#$/$0$0$4$;$B$B$G$H$J$O$Q$]$^$m$n${$~
                                                                                                                                                                                                                        • API String ID: 2525500382-534244583
                                                                                                                                                                                                                        • Opcode ID: 88941a0f473d950aaf799373c472504fdf4e728c02f445fde5d667b58de91daa
                                                                                                                                                                                                                        • Instruction ID: 4269c404afaea1df1efd4a1c8208bd9eeef8084854f19ae64706ebcfc8f60f0e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 88941a0f473d950aaf799373c472504fdf4e728c02f445fde5d667b58de91daa
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3481076010CBC289D322C63C881875FBFD15BE7224F184B9DE1F98B3E6D6A58546C767
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AllocString
                                                                                                                                                                                                                        • String ID: $#$/$0$0$4$;$B$B$G$H$J$O$Q$]$^$m$n${$~
                                                                                                                                                                                                                        • API String ID: 2525500382-534244583
                                                                                                                                                                                                                        • Opcode ID: bfb36de6ec62216300921940dd90e50556119a09abea61977352c50feb6b8cd0
                                                                                                                                                                                                                        • Instruction ID: e21bf8ef08eaefae2f6608d65dd533aaf672cde794620ee92b713000d27e8169
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bfb36de6ec62216300921940dd90e50556119a09abea61977352c50feb6b8cd0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9981F52010CBC289D326C63C885875FBFD16BE7224F184B9DE1F58B3E6D6A98146C727
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AllocString
                                                                                                                                                                                                                        • String ID: $#$/$0$0$4$;$B$B$G$H$J$O$Q$]$^$m$n${$~
                                                                                                                                                                                                                        • API String ID: 2525500382-534244583
                                                                                                                                                                                                                        • Opcode ID: bfb36de6ec62216300921940dd90e50556119a09abea61977352c50feb6b8cd0
                                                                                                                                                                                                                        • Instruction ID: a4d2fc7cf65ff361df50ef7f4e5acacf5236f546f056a11b09f3885386afadcb
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bfb36de6ec62216300921940dd90e50556119a09abea61977352c50feb6b8cd0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1181D42010CBC289D326C63C885875FBFD16BE7224F184B9DE1F58B3E6D6A98146D727
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Variant$ClearInit
                                                                                                                                                                                                                        • String ID: ($*$,$-$.$0$2$4$6$8$:$<$>$Q$T$W$b
                                                                                                                                                                                                                        • API String ID: 2610073882-1095711290
                                                                                                                                                                                                                        • Opcode ID: 7ffbdfa689dec1bd21887cc542622a7e9519c13530b26af4dda8f001440ba417
                                                                                                                                                                                                                        • Instruction ID: 67e1650e07e25dd8c979730081919a9ec74336f1c366e84b3847a4c8d399cf69
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7ffbdfa689dec1bd21887cc542622a7e9519c13530b26af4dda8f001440ba417
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 19410921108BC1CED726CF388488646BFA16F66224F0886DDD8E54F3DBC775D51AC7A6
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Variant$ClearInit
                                                                                                                                                                                                                        • String ID: ($*$,$-$.$0$2$4$6$8$:$<$>$Q$T$W$b
                                                                                                                                                                                                                        • API String ID: 2610073882-1095711290
                                                                                                                                                                                                                        • Opcode ID: 7ffbdfa689dec1bd21887cc542622a7e9519c13530b26af4dda8f001440ba417
                                                                                                                                                                                                                        • Instruction ID: 93031c7a478e0cc0ce2788ab1cabbc36e07a12c57f69f19710b38df23c623e51
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7ffbdfa689dec1bd21887cc542622a7e9519c13530b26af4dda8f001440ba417
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 19410821108BC1CED726CF388488646BFA16F66224F0886DDD8E54F3DBC775D51ACBA6
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Variant$ClearInit
                                                                                                                                                                                                                        • String ID: ($*$,$-$.$0$2$4$6$8$:$<$>$Q$T$W$b
                                                                                                                                                                                                                        • API String ID: 2610073882-1095711290
                                                                                                                                                                                                                        • Opcode ID: f781027231551062226cb081f6f7d4146a3b5f5555bc5acf262f956389af0b84
                                                                                                                                                                                                                        • Instruction ID: 5aee6742307bd22be2b72699ebf7517107c7abda4f37a595e92ffc77e439cf83
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f781027231551062226cb081f6f7d4146a3b5f5555bc5acf262f956389af0b84
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 34410820108BC1CED726CF3C9488616BFA16B66224F488ADDD8E54F3DBC375D51ACB66
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Variant$ClearInit
                                                                                                                                                                                                                        • String ID: ($*$,$-$.$0$2$4$6$8$:$<$>$Q$T$W$b
                                                                                                                                                                                                                        • API String ID: 2610073882-1095711290
                                                                                                                                                                                                                        • Opcode ID: f781027231551062226cb081f6f7d4146a3b5f5555bc5acf262f956389af0b84
                                                                                                                                                                                                                        • Instruction ID: babc65ffe6927fc0a6a7ac79ccaffe2bce176df0c2783c39eead541c0a607e96
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f781027231551062226cb081f6f7d4146a3b5f5555bc5acf262f956389af0b84
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EF41E820108BC1CED726CF3C8498616BFA16B66224F088ADDD8E54F3DBC375D519CB66
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InitVariant
                                                                                                                                                                                                                        • String ID: @$@$A$C$E$H$J$L$Q$X$X$[$[$e
                                                                                                                                                                                                                        • API String ID: 1927566239-3011065302
                                                                                                                                                                                                                        • Opcode ID: 525d7f934687ab0bf19ac530d90f1e1fa4e045b28120346783632a559e286019
                                                                                                                                                                                                                        • Instruction ID: 53b19800ce9beadd92bbeaf8c0dd5e513984ffb5c5a49c85e3815ab243118963
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 525d7f934687ab0bf19ac530d90f1e1fa4e045b28120346783632a559e286019
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0541097010C7C18AD365DB28849878BBFE16B96314F885A9CE6E94B3E2C7798409C757
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InitVariant
                                                                                                                                                                                                                        • String ID: @$@$A$C$E$H$J$L$Q$X$X$[$[$e
                                                                                                                                                                                                                        • API String ID: 1927566239-3011065302
                                                                                                                                                                                                                        • Opcode ID: 38b59cd13938fe8317dc7d58eddabe9e0085401b214a797582b7f2cd6e6565e9
                                                                                                                                                                                                                        • Instruction ID: 58539203c6f86944dfb1310c8f2e1b60991bb69a5b26683da49a484ed54f9969
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 38b59cd13938fe8317dc7d58eddabe9e0085401b214a797582b7f2cd6e6565e9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6741097010C7C18ED365DB28849878FBFE16B96314F885A9CE5E94B3E2C7798445CB53
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InitVariant
                                                                                                                                                                                                                        • String ID: @$@$A$C$E$H$J$L$Q$X$X$[$[$e
                                                                                                                                                                                                                        • API String ID: 1927566239-3011065302
                                                                                                                                                                                                                        • Opcode ID: 2ee573a903be5f004d3e2d813880161334ac93031f736f9e15fdb26375ef605a
                                                                                                                                                                                                                        • Instruction ID: f917ff13e8fa353cdd9af704c32342f25a9e0069aca0bae3d4b305f03d6e9fde
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2ee573a903be5f004d3e2d813880161334ac93031f736f9e15fdb26375ef605a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F841187000D7C18AD3619B28849874FBFE06BA7324F885A9DF6E84B3E2C77984498757
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InitVariant
                                                                                                                                                                                                                        • String ID: @$@$A$C$E$H$J$L$Q$X$X$[$[$e
                                                                                                                                                                                                                        • API String ID: 1927566239-3011065302
                                                                                                                                                                                                                        • Opcode ID: 1f6040f1df59cba3b40ed0df49f13582157b33a0c7b331a145014ed0c7e5c107
                                                                                                                                                                                                                        • Instruction ID: a5ce95360efd2f1f7d14b4743257629e43f74a6634e47f4c6ac498f3989775d1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1f6040f1df59cba3b40ed0df49f13582157b33a0c7b331a145014ed0c7e5c107
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4441187040C7C18ED3659B28849878FBFE06BA3214F885A9CF6E94B3E2C7798449C753
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1615486766.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000004.00000002.1615486766.0000000000452000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_400000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Variant$ClearInit
                                                                                                                                                                                                                        • String ID: A$e$e$n$p$p$v$w$z$z
                                                                                                                                                                                                                        • API String ID: 2610073882-1114116150
                                                                                                                                                                                                                        • Opcode ID: 285518986e989cac88369cedce0e1c7570f99f932fa8b56f27ac7dcd310c1e64
                                                                                                                                                                                                                        • Instruction ID: 776134ba1da329d7d35a817d8e2b42585fa70f537528e7a9cdeab4ed979499a7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 285518986e989cac88369cedce0e1c7570f99f932fa8b56f27ac7dcd310c1e64
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2641383160C7C18ED331DB38885879BBFD1ABA6324F088AADD4E9872D6D7794505C763
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Variant$ClearInit
                                                                                                                                                                                                                        • String ID: A$e$e$n$p$p$v$w$z$z
                                                                                                                                                                                                                        • API String ID: 2610073882-1114116150
                                                                                                                                                                                                                        • Opcode ID: 285518986e989cac88369cedce0e1c7570f99f932fa8b56f27ac7dcd310c1e64
                                                                                                                                                                                                                        • Instruction ID: 13208db4504f2b6f48c73b084c8fb3fcaf82ef894f3923b45d87011a6bfedb97
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 285518986e989cac88369cedce0e1c7570f99f932fa8b56f27ac7dcd310c1e64
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B241473160C7C18ED331CB38885879BBFD2ABA6324F088AADD4E9872D6D7794505C763
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000004.00000002.1616290875.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_4_2_20b0000_OGBLsboKIF.jbxd
                                                                                                                                                                                                                        Yara matches
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Clipboard$Global$CloseDataLockOpenUnlock
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1006321803-0
                                                                                                                                                                                                                        • Opcode ID: c4fbd4c85c730b82bb0d4d983bd35fb8fa0bc5b81fa1c667f8f1a84b0218d30c
                                                                                                                                                                                                                        • Instruction ID: bd987768a593ca4c94789accd49e6d15493bce435828f1eab20000b003428a56
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c4fbd4c85c730b82bb0d4d983bd35fb8fa0bc5b81fa1c667f8f1a84b0218d30c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7451E2F1D087928FDB00AB78C4493AEFFE4AB41310F048639D99A97291D3799994D7A3